code-projects Simple Food Order System Parameter all-orders.php sql injection

A security vulnerability has been detected in code-projects Simple Food Order System 1.0. Affected by this vulnerability is an unknown functionality of the file all-orders.php of the component Parameter Handler. The manipulation of the argument Status leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

SQL命令中使用的特殊元素转义处理不恰当(SQL注入)

Code-Projects Simple Food Order System SQL注入漏洞

Code-Projects Simple Food Order System是Code-Projects开源的一个简单的食品订购系统。 code-projects Simple Food Order System 1.0版本存在SQL注入漏洞，该漏洞源于组件Parameter Handler中文件all-orders.php的未知功能对参数Status操作不当，可能导致SQL注入。

N/A

N/A