CVE-2023-2677

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability, which was classified as critical, was found in SourceCodester Covid-19 Contact Tracing System 1.0. This affects an unknown part of the file admin/establishment/manage.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-228891.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
SourceCodester	Covid-19 Contact Tracing System	1.0

References

https://github.com/BacteriaJun/cve/blob/main/SQL.mdExploit
https://vuldb.com/?ctiid.228891Permissions Required, Third Party Advisory, VDB Entry
https://vuldb.com/?id.228891Permissions Required, Third Party Advisory, VDB Entry
https://github.com/BacteriaJun/cve/blob/main/SQL.mdExploit
https://vuldb.com/?ctiid.228891Permissions Required, Third Party Advisory, VDB Entry
https://vuldb.com/?id.228891Permissions Required, Third Party Advisory, VDB Entry

Timeline

Published: May 12, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-267709.8TaskCafe 0.3.2 lacks validation in the Cookie value. Any unauthenticated attacker who knows a registered UserID can change the password of t CVE-2023-267716.5Taskcafe 0.3.2 is vulnerable to Cross Site Scripting (XSS). There is a lack of validation in the filetype when uploading a SVG profile pictu CVE-2023-267736.1Cross Site Scripting vulnerability found in Sales Tracker Management System v.1.0 allows a remote attacker to gain privileges via the produc CVE-2023-267747.5An issue found in Sales Tracker Management System v.1.0 allows a remote attacker to access sensitive information via sales.php component of CVE-2023-267757.8File Upload vulnerability found in Monitorr v.1.7.6 allows a remote attacker t oexecute arbitrary code via a crafted file upload to the asse CVE-2023-267766.1Cross Site Scripting vulnerability found in Monitorr v.1.7.6 allows a remote attacker to execute arbitrary code via the title parameter of t CVE-2023-267776.1Cross Site Scripting vulnerability found in : louislam Uptime Kuma v.1.19.6 and before allows a remote attacker to execute arbitrary command CVE-2023-267799.8CleverStupidDog yf-exam v 1.8.0 is vulnerable to Deserialization which can lead to remote code execution (RCE).CVE-2023-26785.4A vulnerability has been found in SourceCodester File Tracker Manager System 1.0 and classified as problematic. This vulnerability affects u CVE-2023-267809.8CleverStupidDog yf-exam v 1.8.0 is vulnerable to SQL Injection.CVE-2023-267819.8SQL injection vulnerability in mccms 2.6 allows remote attackers to run arbitrary SQL commands via Author Center ->Reader Comments ->Search.CVE-2023-267826.5An issue discovered in mccms 2.6.1 allows remote attackers to cause a denial of service via Backend management interface ->System Configurat