CVE-2023-45343: Online Food Ordering System v1.0 - Multiple Unauthenticated SQL Injections (SQLi)

Published Nov 2, 2023

Updated

Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'ticketid' parameter of the routers/ticket-message.php resource does not validate the characters received and they are sent unfiltered to the database.

Affected Software

1 affected component

Projectworlds Online Food Ordering System=1.0

Event History

Nov 2, 2023

CVE Published

01:59 PM

Data Sourced

01:59 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the vulnerability ID for this issue?

The vulnerability ID for this issue is CVE-2023-45343.

What is the severity level of CVE-2023-45343?

CVE-2023-45343 has a severity level of critical.

What is the affected software?

The affected software is Online Food Ordering Script version 1.0.

How can I exploit this vulnerability?

To exploit this vulnerability, an attacker needs to send unfiltered characters to the 'ticket_id' parameter of the routers/ticket-message.php resource.

Are there any references available for more information?

Yes, you can find more information about this vulnerability at the following references: [Fluid Attacks Advisory](https://fluidattacks.com/advisories/hann) and [Project Worlds](https://projectworlds.in/).