Kashipara Billing Software v1.0 Unauthenticated SQLi Vulnerabilities (CVE-2023-49622 et al.)

Critical Vulnerability Information Vulnerability Overview Vulnerability Name: Billing Software v1.0 - Multiple SQLi Discoverer: Andres Boldan Status: Public Release Date: Dec 6, 2023 Affected Product: Billing Software Vendor: Kashipara Group Affected Version: Version 1.0 Vulnerability Type: Unauthenticated SQL Injections (SQLi) Remotely Exploitable: Yes CVSS v3.0 Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:A/H CVSS v3.0 Base Score: 9.8 CVE ID: CVE-2023-49622, CVE-2023-49624, CVE-2023-49625, CVE-2023-49633, CVE-2023-49639, CVE-2023-49641, CVE-2023-49658, CVE-2023-49665, CVE-2023-49666 Timeline Vulnerability Discovery: Nov 24, 2023 Vendor Contacted: Dec 2, 2023 Public Disclosure: Dec 6, 2023 Vulnerability Description Billing Software v1.0 contains multiple unauthenticated SQL injection vulnerabilities. Vulnerability Details CVE-2023-49622: The parameter does not validate characters and is directly sent to the database. CVE-2023-49624: The parameter does not validate characters and is directly sent to the database. CVE-2023-49625: The parameter does not validate characters and is directly sent to the database. CVE-2023-49633: The parameter does not validate characters and is directly sent to the database. CVE-2023-49639: The parameter does not validate characters and is directly sent to the database. CVE-2023-49641: The parameter does not validate characters and is directly sent to the database. CVE-2023-49658: The parameter does not validate characters and is directly sent to the database. CVE-2023-49665: The parameter does not validate characters and is directly sent to the database. CVE-2023-49666: The parameter does not validate characters and is directly sent to the database. Mitigation No patches are currently available to address this vulnerability. System Information Version: Billing Software v1.0 Operating System: Any References Vendor Website: https://www.kashipara.com/

Goal Reached Thanks to every supporter — we hit 100%!

Kashipara Billing Software v1.0 Unauthenticated SQLi Vulnerabilities (CVE-2023-49622 et al.)