CVE-2023-34581
Published: 12 June 2023
Summary
CVE-2023-34581 is a critical-severity SQL Injection (CWE-89) vulnerability in Oretnom23 Service Provider Management System. Its CVSS base score is 9.8 (Critical).
Operationally, ranked at the 44.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
Sourcecodester Service Provider Management System version 1.0 contains a SQL injection vulnerability in the ID parameter of the endpoint /php-spms/?page=services/view. The flaw is tracked as CVE-2023-34581 with a CVSS 3.1 score of 9.8 and is classified under CWE-89.
An unauthenticated attacker with network access can supply a crafted SQL payload through the ID parameter to read, modify, or delete database contents and potentially execute operating-system commands, resulting in full compromise of the affected application and its data.
Public exploit code for the issue has been published on Exploit-DB, Packet Storm, and GitHub. The EPSS score rose materially from a low baseline to a peak of 0.1283 on 2025-01-22 before receding to its current value of 0.0022, indicating a period of increased exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-38636
Vulnerability details
Sourcecodester Service Provider Management System v1.0 is vulnerable to SQL Injection via the ID parameter in /php-spms/?page=services/view&id=2
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.