simple_client_management_system_project - MidnightBSD Security Advisories

CVE-2021-43484 HIGH

A Remote Code Execution (RCE) vulnerability exists in Simple Client Management System 1.0 in create.php due to the failure to validate the extension of the file being sent in a request.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9

CVSS 2.0

Severity: HIGH

Problem Type: CWE-89,

Products Affected

Vendor	Product	Version
simple_client_management_system_project	simple_client_management_system	1.0

CVE-2021-43505 LOW

Multiple Cross Site Scripting (XSS) vulnerabilities exist in Ssourcecodester Simple Client Management System v1 via (1) Add new Client and (2) Add new invoice.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	5.4	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N	2.3	2.7

CVSS 2.0

Severity: LOW

Problem Type: CWE-79,

Products Affected

Vendor	Product	Version
simple_client_management_system_project	simple_client_management_system	1.0

CVE-2021-43506 HIGH

An SQL Injection vulnerability exists in Sourcecodester Simple Client Management System 1.0 via the password parameter in Login.php.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9

CVSS 2.0

Severity: HIGH

Problem Type: CWE-89,

Products Affected

Vendor	Product	Version
simple_client_management_system_project	simple_client_management_system	1.0

CVE-2021-43509 HIGH

SQL Injection vulnerability exists in Sourcecodester Simple Client Management System 1.0 via the id parameter in view-service.php.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9

CVSS 2.0

Severity: HIGH

Problem Type: CWE-89,

Products Affected

Vendor	Product	Version
simple_client_management_system_project	simple_client_management_system	1.0

CVE-2021-43510 HIGH

SQL Injection vulnerability exists in Sourcecodester Simple Client Management System 1.0 via the username field in login.php.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9

CVSS 2.0

Severity: HIGH

Problem Type: CWE-89,

Products Affected

Vendor	Product	Version
simple_client_management_system_project	simple_client_management_system	1.0

CVE-2021-43657

A Stored Cross-site scripting (XSS) vulnerability via MAster.php in Sourcecodetester Simple Client Management System (SCMS) 1.0 allows remote attackers to inject arbitrary web script or HTML via the vulnerable input fields.

Products Affected

Vendor	Product	Version
simple_client_management_system_project	simple_client_management_system	1.0

CVE-2022-26284 HIGH

Simple Client Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter in the manage_client endpoint. This vulnerability allows attackers to dump the application's database via crafted HTTP requests.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9

CVSS 2.0

Severity: HIGH

Problem Type: CWE-89,

Products Affected

Vendor	Product	Version
simple_client_management_system_project	simple_client_management_system	1.0

CVE-2022-26285 HIGH

Simple Subscription Website v1.0 was discovered to contain a SQL injection vulnerability via the id parameter in the apply endpoint. This vulnerability allows attackers to dump the application's database via crafted HTTP requests.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9

CVSS 2.0

Severity: HIGH

Problem Type: CWE-89,

Products Affected

Vendor	Product	Version
simple_client_management_system_project	simple_client_management_system	1.0

CVE-2022-29747 HIGH

Simple Client Management System 1.0 is vulnerable to SQL Injection via /cms/admin/?page=invoice/manage_invoice&id= // Leak place ---> id.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9

CVSS 2.0

Severity: HIGH

Problem Type: CWE-89,

Products Affected

Vendor	Product	Version
simple_client_management_system_project	simple_client_management_system	1.0

CVE-2022-29748 HIGH

Simple Client Management System 1.0 is vulnerable to SQL Injection via \cms\admin?page=client/manage_client&id=.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9

CVSS 2.0

Severity: HIGH

Problem Type: CWE-89,

Products Affected

Vendor	Product	Version
simple_client_management_system_project	simple_client_management_system	1.0

CVE-2022-29749 HIGH

Simple Client Management System 1.0 is vulnerable to SQL Injection via /cms/classes/Master.php?f=delete_invoice.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9

CVSS 2.0

Severity: HIGH

Problem Type: CWE-89,

Products Affected

Vendor	Product	Version
simple_client_management_system_project	simple_client_management_system	1.0

CVE-2022-29750 HIGH

Simple Client Management System 1.0 is vulnerable to SQL Injection via /cms/classes/Master.php?f=delete_service.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9

CVSS 2.0

Severity: HIGH

Problem Type: CWE-89,

Products Affected

Vendor	Product	Version
simple_client_management_system_project	simple_client_management_system	1.0

CVE-2022-29751 HIGH

Simple Client Management System 1.0 is vulnerable to SQL Injection via /cms/classes/Master.php?f=delete_client.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9

CVSS 2.0

Severity: HIGH

Problem Type: CWE-89,

Products Affected

Vendor	Product	Version
simple_client_management_system_project	simple_client_management_system	1.0

CVE-2022-29979 HIGH

Simple Client Management System 1.0 is vulnerable to SQL Injection via /cms/classes/Master.php?f=delete_designation.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9

CVSS 2.0

Severity: HIGH

Problem Type: CWE-89,

Products Affected

Vendor	Product	Version
simple_client_management_system_project	simple_client_management_system	1.0

CVE-2022-29980 HIGH

Simple Client Management System 1.0 is vulnerable to SQL Injection via /cms/admin/?page=user/manage_user&id=.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9

CVSS 2.0

Severity: HIGH

Problem Type: CWE-89,

Products Affected

Vendor	Product	Version
simple_client_management_system_project	simple_client_management_system	1.0

CVE-2022-29981 HIGH

Simple Client Management System 1.0 is vulnerable to SQL Injection via /cms/classes/Users.php?f=delete.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9

CVSS 2.0

Severity: HIGH

Problem Type: CWE-89,

Products Affected

Vendor	Product	Version
simple_client_management_system_project	simple_client_management_system	1.0

CVE-2022-29982 HIGH

Simple Client Management System 1.0 is vulnerable to SQL Injection via /cms/admin/maintenance/manage_service.php?id=.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9

CVSS 2.0

Severity: HIGH

Problem Type: CWE-89,

Products Affected

Vendor	Product	Version
simple_client_management_system_project	simple_client_management_system	1.0

CVE-2022-29983 HIGH

Simple Client Management System 1.0 is vulnerable to SQL Injection via /cms/admin/?page=invoice/view_invoice&id=.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9

CVSS 2.0

Severity: HIGH

Problem Type: CWE-89,

Products Affected

Vendor	Product	Version
simple_client_management_system_project	simple_client_management_system	1.0

CVE-2022-29984 HIGH

Simple Client Management System 1.0 is vulnerable to SQL Injection via /cms/admin/?page=client/view_client&id=.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9

CVSS 2.0

Severity: HIGH

Problem Type: CWE-89,

Products Affected

Vendor	Product	Version
simple_client_management_system_project	simple_client_management_system	1.0

Advisories for simple_client_management_system_project