CVE-2023-6312

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

A vulnerability was found in SourceCodester Loan Management System 1.0. It has been classified as critical. Affected is the function delete_user of the file deleteUser.php of the component Users Page. The manipulation of the argument user_id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-246138 is the identifier assigned to this vulnerability.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
SourceCodester	Loan Management System	1.0

References

https://github.com/joinia/webray.com.cn/blob/main/Loan-Management-System/lmssql%20-%20deleteuser.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.246138Permissions Required, Third Party Advisory
https://vuldb.com/?id.246138Permissions Required, Third Party Advisory
https://github.com/joinia/webray.com.cn/blob/main/Loan-Management-System/lmssql%20-%20deleteuser.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.246138Permissions Required, Third Party Advisory
https://vuldb.com/?id.246138Permissions Required, Third Party Advisory

Timeline

Published: Nov 27, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-63136.1A vulnerability was found in SourceCodester URL Shortener 1.0. It has been declared as problematic. Affected by this vulnerability is an unk CVE-2023-63147.8Stack-based buffer overflow in FPWin Pro version 7.7.0.0 and all previous versions may allow attackers to execute arbitrary code via a speci CVE-2023-63157.8Out-of-bouds read vulnerability in FPWin Pro version 7.7.0.0 and all previous versions may allow attackers to execute arbitrary code via a s CVE-2023-63169.8The MW WP Form plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the '_single_file_up CVE-2023-63179.8A prompt bypass exists in the secondscreen.gateway service running on webOS version 4 through 7. An attacker can create a privileged account CVE-2023-63187.2A command injection vulnerability exists in the processAnalyticsReport method from the com.webos.service.cloudupload service on webOS versio CVE-2023-63197.2A command injection vulnerability exists in the getAudioMetadata method from the com.webos.service.attachedstoragemanager service on webOS v CVE-2023-63207.2A command injection vulnerability exists in the com.webos.service.connectionmanager/tv/setVlanStaticAddress endpoint on webOS versions 5 and CVE-2023-63218.8A command injection vulnerability exists in the IOCTL that manages OTA updates. A specially crafted command can lead to command execution as CVE-2023-63228.8A stack-based buffer overflow vulnerability exists in the message parsing functionality of the Roku Indoor Camera SE version 3.0.2.4679 and CVE-2023-63236.5ThroughTek Kalay SDK does not verify the authenticity of received messages, allowing an attacker to impersonate an authoritative server.CVE-2023-63248.8ThroughTek Kalay SDK uses a predictable PSK value in the DTLS session when encountering an unexpected PSK identity