CVE-2023-1909 - PHPGurukul BP Monitoring Management System User Profile Update profile.php sql injection

Back Back to CVE browser

MEDIUM

PHPGurukul BP Monitoring Management System User Profile Update profile.php sql injection

Published Apr 7, 2023

6.5

MEDIUM

CVSS 3.1

EPSS 0.63%

Description

A vulnerability, which was classified as critical, was found in PHPGurukul BP Monitoring Management System 1.0. Affected is an unknown function of the file profile.php of the component User Profile Update Handler. The manipulation of the argument name/mobno leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-225318 is the identifier assigned to this vulnerability.

Affected products

Vendor PHP Gurukul Product BP Monitoring Management System Default
n/a
- Version
  1.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

PHP Gurukul

BP Monitoring Management System

n/a

Version	Status	Constraints
1.0	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-89

SQL Injection

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-24097
Advisory
https://github.com/vsdwef/BP-Monitoring-Management-System/blob/main/report_English.pdf
exploitThird Party Advisory
https://vuldb.com/?ctiid.225318
signaturepermissions-requiredPermissions RequiredThird Party Advisory
https://vuldb.com/?id.225318
vdb-entrytechnical-descriptionThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-24097		Advisory
https://github.com/vsdwef/BP-Monitoring-Management-System/blob/main/report_English.pdf		exploitThird Party Advisory
https://vuldb.com/?ctiid.225318		signaturepermissions-requiredPermissions RequiredThird Party Advisory
https://vuldb.com/?id.225318		vdb-entrytechnical-descriptionThird Party Advisory