CVE-2020-24862

EUVD-2020-17570 · Published Jun 2, 2021

The catID parameter in Pharmacy Medical Store and Sale Point v1.0 has been found to be vulnerable to a Time-Based blind SQL injection via the /medical/inventories.php path which allows attackers to retrieve all databases.

Technologies

Pharmacy_Medical_Store_And_Sale_Point_Project Pharmacy Medical Store And Sale Point

Weaknesses

CWE-89

CVSS scores

v3.17.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
v2.05.0AV:N/AC:L/Au:N/C:P/I:N/A:N

MITRE ATT&CK

Inferred

Where this vulnerability fits in an attack

ReconImpact

Initial Access

T1190Exploit Public-Facing Application

References

https://www.exploit-db.com/exploits/48752
https://www.sourcecodester.com/download-code?nid=14398&title=Pharmacy%2FMedical+Store+%26+Sale+Point+Using+PHP%2FMySQL+with+Bootstrap+Framework
https://www.sourcecodester.com/php/14398/pharmacymedical-store-sale-point-using-phpmysql-bootstrap-framework.html

Potentially impacted assets

See if this affects your attack surface