CVE-2023-1557 SourceCodester E-Commerce System Username access control
Attackers can bypass access controls to modify user data via the username handler in SourceCodester E-Commerce System.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-1557?
CVE-2023-1557 is a medium-severity missing authorization vulnerability in SourceCodester E-Commerce System, published on 22 Mar 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A vulnerability was found in SourceCodester E-Commerce System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /ecommerce/admin/user/controller.php?action=edit of the component Username Handler. The manipulation of the argument USERID leads to improper access controls. The attack may be launched remotely. VDB-223550 is the identifier assigned to this vulnerability.
Weakness: CWE-284
Which versions are affected by CVE-2023-1557?
It affects 1 product.
Products include E-Commerce System Project E-Commerce System.
How do I fix CVE-2023-1557?
No fix has been published for CVE-2023-1557 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2023-1557 being exploited?
There is no known exploitation of CVE-2023-1557 in the wild and no public exploit code.
Other vulnerabilities in SourceCodester E-Commerce System
- CVE-2023-1506 SourceCodester E-Commerce System login.php sql injection
- CVE-2023-1505 SourceCodester E-Commerce System setDiscount.php sql injection
- CVE-2023-1569 SourceCodester E-Commerce System cross site scripting
- CVE-2023-1507 SourceCodester E-Commerce System Category Name controller.php cross site scripting
Sources
Also known as GHSA-6523-c2p9-hgjx.