Online Notice Board System v1.0 - SQLi

Description

Online Notice Board System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities.

Vulnerabilities

CVE-2023-50743

The 'dd' parameter of the registration.php resource does not validate the characters received and they are sent unfiltered to the database. The vulnerable code is:

CVE-2023-50752

The 'e' parameter of the login.php resource does not validate the characters received and they are sent unfiltered to the database. The vulnerable code is:

extract($_POST);
if(isset($save))
{

 if($e=="" || $p=="")
 {
 $err="<font color='red'>fill all the fileds first</font>

CVE-2023-50753

The 'dd' parameter of the user/update_profile.php resource does not validate the characters received and they are sent unfiltered to the database. The vulnerable code is:

Our security policy

We have reserved the IDs CVE-2023-50743, CVE-2023-50752 and CVE-2023-50753 to refer to these issues from now on.

Disclosure policy

System Information

• Version: Online Notice Board System v1.0

• Operating System: Any

Mitigation

There is currently no patch available for this vulnerability.

References

• Vendor page https://www.kashipara.com/