CVE-2023-3988

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in Cafe Billing System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file index.php of the component Order Handler. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-235609 was assigned to this vulnerability.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	Cafe Billing System	1.0

References

https://github.com/excuses0217/CveHub/blob/main/Cafe%20Billing%20System%20index.php%20has%20Sqlinjection.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.235609Permissions Required, Third Party Advisory, VDB Entry
https://vuldb.com/?id.235609Third Party Advisory, VDB Entry
https://github.com/excuses0217/CveHub/blob/main/Cafe%20Billing%20System%20index.php%20has%20Sqlinjection.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.235609Permissions Required, Third Party Advisory, VDB Entry
https://vuldb.com/?id.235609Third Party Advisory, VDB Entry

Timeline

Published: Jul 28, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-39896.1A vulnerability was found in SourceCodester Jewelry Store System 1.0. It has been rated as problematic. Affected by this issue is some unkno CVE-2023-39906.1A vulnerability classified as problematic has been found in Mingsoft MCMS up to 5.3.1. This affects an unknown part of the file search.do of CVE-2023-399027.8A software vulnerability has been identified in the U-Boot Secondary Program Loader (SPL) before 2023.07 on select NXP i.MX 8M family proces CVE-2023-399035.0An issue was discovered in Fujitsu Software Infrastructure Manager (ISM) before 2.8.0.061. The ismsnap component (in this specific case at /CVE-2023-399087.5The PKCS11 module of the YubiHSM 2 SDK through 2023.01 does not properly validate the length of specific read operations on object metadata.CVE-2023-399098.8Ericsson Network Manager before 23.2 mishandles Access Control and thus unauthenticated low-privilege users can access the NCM application.CVE-2023-39919.8An OS command injection vulnerability exists in the httpd iperfrun.cgi functionality of FreshTomato 2023.3. A specially crafted HTTP request CVE-2023-399107.5The cryptocurrency wallet entropy seeding mechanism used in Libbitcoin Explorer 3.0.0 through 3.6.0 is weak, aka the Milk Sad issue. The use CVE-2023-399124.9Zoho ManageEngine ADManager Plus before 7203 allows Help Desk Technician users to read arbitrary files on the machine where this product is CVE-2023-399138.8Deserialization of Untrusted Data, Improper Input Validation vulnerability in Apache UIMA Java SDK, Apache UIMA Java SDK, Apache UIMA Java S CVE-2023-399147.5NLnet Labs' bcder library up to and including version 0.7.2 panics while decoding certain invalid input data rather than rejecting the data CVE-2023-399157.5NLnet Labs' Routinator up to and including version 0.12.1 may crash when trying to parse certain malformed RPKI objects. This is due to insu