CVE-2023-2643

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability classified as critical was found in SourceCodester File Tracker Manager System 1.0. This vulnerability affects unknown code of the file register/update_password.php of the component POST Parameter Handler. The manipulation of the argument new_password leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-228772.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
SourceCodester	File Tracker Manager System	1.0

References

https://github.com/GZRsecurity/cve/blob/main/SQLi.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.228772Third Party Advisory
https://vuldb.com/?id.228772Third Party Advisory
https://github.com/GZRsecurity/cve/blob/main/SQLi.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.228772Third Party Advisory
https://vuldb.com/?id.228772Third Party Advisory

Timeline

Published: May 11, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-264304.3Attackers with access to user accounts can inject arbitrary control characters to SIEVE mail-filter rules. This could be abused to access SI CVE-2023-264314.3IPv4-mapped IPv6 addresses did not get recognized as "local" by the code and a connection attempt is made. Attackers with access to user acc CVE-2023-264324.3When adding an external mail account, processing of SMTP "capabilities" responses are not limited to plausible sizes. Attacker with access t CVE-2023-264334.3When adding an external mail account, processing of IMAP "capabilities" responses are not limited to plausible sizes. Attacker with access t CVE-2023-264344.3When adding an external mail account, processing of POP3 "capabilities" responses are not limited to plausible sizes. Attacker with access t CVE-2023-264355.0It was possible to call filesystem and network references using the local LibreOffice instance using manipulated ODT documents. Attackers co CVE-2023-264368.8Attackers with access to the "documentconverterws" API were able to inject serialized Java objects, that were not properly checked during de CVE-2023-264375.3Denial of service vulnerability in PowerDNS Recursor allows authoritative servers to be marked unavailable.This issue affects Recursor: thro CVE-2023-264383.1External service lookups for a number of protocols were vulnerable to a time-of-check/time-of-use (TOCTOU) weakness, involving the JDK DNS c CVE-2023-264397.8The cacheservice API could be abused to inject parameters with SQL syntax which was insufficiently sanitized before getting executed as SQL CVE-2023-26447.8A vulnerability, which was classified as problematic, has been found in DigitalPersona FPSensor 1.0.0.1. This issue affects some unknown pro CVE-2023-264407.8The cacheservice API could be abused to indirectly inject parameters with SQL syntax which was insufficiently sanitized and would later be e