PT-2021-23748
CVE-2021-43130
·
Published
2021-11-03
·
Updated
2021-11-17
Description by
CVSS 2.0
10
CriticalMetricsAV:N/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions
Sourcecodester Customer Relationship Management System (CRM) version 1.0
Description
An SQL Injection issue exists via the
username parameter in the "customer/login.php" endpoint. This allows for potential exploitation.Recommendations
For version 1.0, consider restricting access to the
customer/login.php endpoint until a fix is available, and avoid using the username parameter in this context to minimize the risk of exploitation. Found an issue in the description? Have something to add? Feel free to write us 👾