CVE-2023-30112

Vulnerability

Medicine Tracker System in PHP version 1.0.0 contains a SQL injection vulnerability [1]. The application fails to properly sanitize user-controlled input before using it in SQL queries. The exact parameters vulnerable have been documented in the reference [1]. This software is a web-based medicine tracking application written in PHP.

Exploitation

An unauthenticated attacker can exploit this vulnerability by sending crafted HTTP requests to the affected parameters [1]. No authentication is required. The attacker can inject malicious SQL statements through input fields, which are processed by the backend database without proper sanitization.

Impact

Successful exploitation allows an attacker to extract, modify, or delete arbitrary data from the application's database [1]. This can lead to disclosure of sensitive patient or medical information, and potentially complete compromise of the database server's data.

Mitigation

No patched version has been released [1]. As a mitigation, users should implement input validation and parameterized queries in the application code to prevent SQL injection. The vendor should be contacted for an official fix.