VulnerabilityModified
CVE-2023-50035
PHPGurukul Small CRM 3.0 is vulnerable to SQL Injection on the Users login panel because of "password" parameter is directly used in the SQL query without any sanitization and the SQL Injection payload being executed.
CRITICAL 9.8EPSS 0.63%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.63%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
PHPGurukul Small CRM 3.0 is vulnerable to SQL Injection on the Users login panel because of "password" parameter is directly used in the SQL query without any sanitization and the SQL Injection payload being executed.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.63% probability · 48th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-89
- Affected
- small crm project/small crm
- Source
- cve@mitre.org
References
- https://github.com/hackerhijeck/Exploited/blob/main/Small_CRM/SQL-Injection.mdExploit, Mitigation, Third Party Advisory
- https://github.com/hackerhijeck/Exploited/blob/main/Small_CRM/SQL-Injection.mdExploit, Mitigation, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.