vendor:
Point of Sales
by:
Jyotsna Adhana
7.5
CVSS
HIGH
SQL Injection
89
CWE
Product Name: Point of Sales
Affected Version From: 1.0
Affected Version To: 1.0
Patch Exists: NO
Related CWE: N/A
CPE: a:sourcecodester:point_of_sales:1.0
Metasploit:
N/A
Other Scripts:
N/A
Platforms Tested: Windows 10 Pro 10.0.18363 N/A Build 18363 + XAMPP V3.2.4
2020
Point of Sales 1.0 – ‘username’ SQL Injection
The Point of Sales 1.0 application is vulnerable to SQL Injection in the 'username' parameter. An attacker can inject malicious SQL code in the 'username' parameter and execute it in the backend database. This can be exploited to gain unauthorized access to the application and the underlying database.
Mitigation:
Input validation should be used to prevent SQL injection attacks. All user-supplied input should be validated and filtered before being used in SQL queries.
