Microwave

**Name of the Vulnerable Software and Affected Versions** itsourcecode Payroll System version 1.0 **Description** A flaw in the CRUD Operation Handler component allows remote attackers to bypass authentication. The issue exists within the create/read/update/delete function of the `ajax.php` file. By manipulating the `action` argument, an attacker can perform unauthorized operations. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** itsourcecode Payroll System version 1.0 **Description** A remote SQL injection is possible through the manipulation of the `Username` argument within the `Login()` function of the admin class.php file. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to the database. **Recommendations** As a temporary workaround, restrict access to the `Login()` function in the admin class.php file or avoid using the `Username` parameter until a fix is applied. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** itsourcecode Payroll System version 1.0 **Description** An unrestricted file upload issue exists in the `save settings()` function within the `admin class.php` file. A remote attacker can exploit this by manipulating the `img` argument to upload arbitrary files to the server. **Recommendations** Update itsourcecode Payroll System version 1.0 to a patched version. As a temporary workaround, restrict access to the `save settings()` function in the `admin class.php` file.

**Name of the Vulnerable Software and Affected Versions** itsourcecode Real Estate Management System version 1.0 **Description** A remote SQL injection issue exists in the `search.php` file. This occurs when manipulating the `search`, `delivery type`, `search price`, or `property type` arguments. SQL injection is a technique where an attacker inserts malicious SQL code into a query, allowing them to manipulate the database. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** itsourcecode Online Pharmacy System version 1.0 **Description** An unrestricted file upload flaw exists in the User Registration component. A remote attacker can manipulate the `photo` argument within the `move uploaded file()` function in the 'all users/register.php' file. This could allow the deployment of a webshell to compromise systems handling prescriptions and patient-linked records. **Recommendations** Update itsourcecode Online Pharmacy System version 1.0 to a version that fixes this issue. As a temporary mitigation, restrict access to the 'all users/register.php' file or disable the `photo` upload functionality.

**Name of the Vulnerable Software and Affected Versions** itsourcecode Online Clinic Management System version 1.0 **Description** An issue in the Admin Login component allows remote exploitation via SQL injection, a technique where malicious SQL statements are inserted into entry fields for execution. The flaw exists in the `success/login.php` endpoint through the manipulation of the `Username` variable, which could enable an attacker to bypass authentication and gain unauthorized administrative access to clinic records and system data. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** itsourcecode Library Management System version 1.0 **Description** A flaw in the `editbooks.php` file allows for remote SQL injection. This occurs when the `ID` argument is manipulated, enabling an attacker to execute unauthorized database queries. **Recommendations** As a temporary workaround, restrict access to the `editbooks.php` file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SourceCodester Pharmacy Sales and Inventory System version 1.0 **Description** A flaw in the `save supplier()` function within the '/ajax.php?action=save supplier' endpoint allows for SQL injection. This occurs through the manipulation of the `ID` argument, enabling remote exploitation. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SourceCodester Pharmacy Sales and Inventory System version 1.0 **Description** An issue exists in the `delete supplier()` function within the '/ajax.php?action=delete supplier' endpoint. Remote manipulation of the `ID` argument allows for SQL injection, a technique where malicious SQL statements are inserted into entry fields for execution. **Recommendations** Update SourceCodester Pharmacy Sales and Inventory System version 1.0 to a patched version. As a temporary workaround, restrict access to the '/ajax.php?action=delete supplier' endpoint or avoid using the `ID` parameter until a fix is applied.

**Name of the Vulnerable Software and Affected Versions** SourceCodester Pharmacy Sales and Inventory System version 1.0 **Description** Cross-site scripting is possible via the `Name` argument within the `Customer()` function of the '/index.php?page=customer' endpoint. This issue allows for remote attacks. **Recommendations** As a temporary workaround, restrict access to the '/index.php?page=customer' endpoint or avoid using the `Name` argument until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** itsourcecode Online Frozen Foods Ordering System version 1.0 **Description** A weakness exists in itsourcecode Online Frozen Foods Ordering System 1.0. The issue is located in an unknown part of the file `/admin/admin edit employee.php`. Manipulation of the `First Name` argument can lead to SQL injection. The attack can be launched remotely. The exploit has been made publicly available. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.