CVE-2023-0562

Deeper analysis

A SQL injection vulnerability exists in PHPGurukul Bank Locker Management System version 1.0. The flaw resides in the index.php file within the Login component, where unsanitized input to the username parameter is passed directly to database queries. The issue is tracked as CWE-89 and carries a CVSS 3.1 base score of 7.3.

An unauthenticated remote attacker can supply crafted input via the login form to execute arbitrary SQL statements. Successful exploitation may allow extraction or modification of limited data and disruption of application functionality, with a publicly available proof-of-concept demonstrating the attack vector.

The EPSS score for this CVE stands at 0.8445, indicating a high likelihood of exploitation attempts. Public references include detailed technical write-ups and exploit code on GitHub and Vuldb, confirming that the issue has been disclosed and is ready for use by threat actors.