CVE-2023-4749 SourceCodester Inventory Management System index.php file inclusion

What is CVE-2023-4749?

CVE-2023-4749 is a medium-severity path traversal vulnerability in SourceCodester Inventory Management System, published on 4 Sep 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A vulnerability, which was classified as critical, was found in SourceCodester Inventory Management System 1.0. Affected is an unknown function of the file index.php. The manipulation of the argument page leads to file inclusion. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-238638 is the identifier assigned to this vulnerability.

Weakness: CWE-73

Which versions are affected by CVE-2023-4749?

It affects 1 product.

Products include Mayurik Inventory Management System.

How do I fix CVE-2023-4749?

No fix has been published for CVE-2023-4749 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2023-4749 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-4749 exists.

Other vulnerabilities in SourceCodester Inventory Management System

• CVE-2023-46449 Missing authorization in n/a High 8.8
• CVE-2023-4199 SourceCodester Inventory Management System catagory_data.php sql injection Medium 6.3
• CVE-2023-4200 SourceCodester Inventory Management System product_data.php. sql injection Medium 6.3
• CVE-2023-4201 SourceCodester Inventory Management System ex_catagory_data.php sql injection Medium 6.3
• CVE-2023-46450 Cross-site scripting in n/a Medium 5.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-59qg-hpf9-jm3r.