A critical vulnerability, CVE-2023-1952, has been identified in the SourceCodester Online Computer and Laptop Store 1.0 software, specifically affecting the Product Search component. This vulnerability, classified as an SQL injection, can be initiated remotely and has been disclosed to the public. The severity of this issue varies, with the NIST CVSS 3.x score rating it as 9.8 (CRITICAL) and the CNA CVSS 3.x score rating it as 6.3 (MEDIUM). Systems running the affected software are at risk, though specific system types are not detailed.

How do I know if I'm affected?

If you're using SourceCodester Online Computer and Laptop Store 1.0 software, you may be affected by the vulnerability. This issue is related to a SQL injection in the Product Search component, specifically in the file /?p=products. Manipulating the search argument with an unknown input can lead to this vulnerability, impacting confidentiality, integrity, and availability. Unfortunately, there is no information available about affected Apple product versions.

What should I do if I'm affected?

If you're affected by the vulnerability, it's important to take action to protect your system. Unfortunately, specific step-by-step instructions are not available from the provided sources. As a general recommendation, consider replacing the affected object with an alternative product. Stay informed about updates and potential countermeasures, and consult with a cybersecurity expert if needed.

Is CVE-2023-1952 in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2023-1952 vulnerability is not listed in CISA's Known Exploited Vulnerabilities Catalog. This critical vulnerability, found in SourceCodester Online Computer and Laptop Store 1.0, affects the Product Search component and is classified as an SQL injection. The vulnerability was disclosed on April 8, 2023. Unfortunately, no specific due date or required action is provided on the NVD page. It is recommended to stay informed about updates and potential countermeasures, and consult with a cybersecurity expert if needed.

Weakness enumeration

The weakness enumeration for this vulnerability is categorized as CWE-89, which involves an SQL injection in the Product Search component of the Online Computer and Laptop Store 1.0. Attackers can manipulate the search argument to exploit this weakness.

For more details

CVE-2023-1952 is a critical vulnerability affecting SourceCodester Online Computer and Laptop Store 1.0 software. For a comprehensive overview of the vulnerability, including its description, severity, technical details, and known affected software configurations, visit the NVD page or the links below.

• Third Party Advisory

• CVE-2023-1952 Detailed Report