high8.8Public exploit code
CVE-2023-24788
NotrinosERP vulnerable to SQL Injection
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- NotrinosERP 0.7 - Authenticated Blind SQL Injection2023-04-07 · webapps · php
Impact
NotrinosERP v0.7 was discovered to contain a SQL injection vulnerability via the OrderNumber parameter at `/NotrinosERP/sales/customer_delivery.php`.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | notrinos/notrinos-erp | <= 0.7 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Notrinos | Notrinoserp | Version 0.7 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- http://packetstormsecurity.com/files/171804/NotrinosERP-0.7-SQL-Injection.html
- https://github.com/arvandy/CVE/blob/main/CVE-2023-24788/CVE-2023-24788.md
- https://github.com/arvandy/CVE/blob/main/CVE-2023-24788/CVE-2023-24788.py
- https://github.com/arvandy/CVE/blob/main/NotrinosERP/POC.md
- https://github.com/notrinos/NotrinosERP
- https://github.com/advisories/GHSA-4pqp-69m3-f8pp
- https://nvd.nist.gov/vuln/detail/CVE-2023-24788