CVE-2023-4176

A vulnerability was found in SourceCodester Hospital Management System 1.0. It has been classified as critical. This affects an unknown part of the file appointmentapproval.php. The manipulation of the argument time leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-236211.

CVSS v3 9.8 CRITICAL
CVSS v2.0 6.5 MEDIUM

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.5^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 8.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://github.com/ayjmytks/Hos-System/blob/main/Hospital%20Management%20System%20appointmentapproval.php%20has%20Sqlinjection.pdf	Exploit Third Party Advisory
https://vuldb.com/?ctiid.236211	Permissions Required Third Party Advisory VDB Entry
https://vuldb.com/?id.236211	Third Party Advisory VDB Entry

Configurations

Configuration 1 (hide)

cpe:2.3:a:hospital_management_system_project:hospital_management_system:1.0:*:*:*:*:*:*:*

History

29 Feb 2024, 01:41

Type	Values Removed	Values Added
Summary		(es) Se ha encontrado una vulnerabilidad en SourceCodester Hospital Management System 1.0. Se ha clasificado como crítica. Afecta a una parte desconocida del archivo "appointmentapproval.php". La manipulación del argumento "time" conduce a una inyección SQL. Es posible iniciar el ataque de forma remota. El exploit ha sido revelado al público y puede ser utilizado. El identificador asociado de esta vulnerabilidad es VDB-236211.

Information

Published : 2023-08-06 02:15

Updated : 2024-05-17 02:31

NVD link : CVE-2023-4176

Mitre link : CVE-2023-4176

CVE.ORG link : CVE-2023-4176

JSON object : View

Products Affected

hospital_management_system_project

hospital_management_system

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2023-4176", "metrics": {"cvssMetricV2": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"version": "2.0", "baseScore": 6.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 2.8}]}, "published": "2023-08-06T02:15:11.147", "references": [{"url": "https://github.com/ayjmytks/Hos-System/blob/main/Hospital%20Management%20System%20appointmentapproval.php%20has%20Sqlinjection.pdf", "tags": ["Exploit", "Third Party Advisory"], "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/?ctiid.236211", "tags": ["Permissions Required", "Third Party Advisory", "VDB Entry"], "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/?id.236211", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cna@vuldb.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "cna@vuldb.com", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in SourceCodester Hospital Management System 1.0. It has been classified as critical. This affects an unknown part of the file appointmentapproval.php. The manipulation of the argument time leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-236211."}, {"lang": "es", "value": "Se ha encontrado una vulnerabilidad en SourceCodester Hospital Management System 1.0. Se ha clasificado como cr\u00edtica. Afecta a una parte desconocida del archivo \"appointmentapproval.php\". La manipulaci\u00f3n del argumento \"time\" conduce a una inyecci\u00f3n SQL. Es posible iniciar el ataque de forma remota. El exploit ha sido revelado al p\u00fablico y puede ser utilizado. El identificador asociado de esta vulnerabilidad es VDB-236211."}], "lastModified": "2024-05-17T02:31:24.177", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hospital_management_system_project:hospital_management_system:1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "36653204-5E38-44E3-B8FD-580F2D27E958"}], "operator": "OR"}]}], "sourceIdentifier": "cna@vuldb.com"}