CVE-2023-49641

Billing Software v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'username' parameter of the loginCheck.php resource does not validate the characters received and they are sent unfiltered to the database.

Score

CVSS 3.1 9.8 Critical

Status

Deferred - help@fluidattacks.com

Published

2025-05-13

Last modified

2025-05-13

Weaknesses

CWE-89

Affected products

• Billing Software (Kashipara Group)

References

• https://fluidattacks.com/advisories/zimerman/
• https://www.kashipara.com/