CVE-2023-40749
Published: 28 August 2023
Summary
CVE-2023-40749 is a critical-severity SQL Injection (CWE-89) vulnerability in Phpjabbers Food Delivery Script. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 2.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
PHPJabbers Food Delivery Script version 3.0 contains a SQL injection vulnerability (CWE-89) in the "column" parameter of index.php. The flaw received a CVSS 3.1 score of 9.8, reflecting network-accessible exploitation without authentication or user interaction and resulting in complete loss of confidentiality, integrity, and availability.
An unauthenticated remote attacker can supply crafted input to the affected parameter and execute arbitrary SQL commands against the application's database. Successful exploitation allows extraction or modification of stored data, authentication bypass, or further compromise of the underlying server.
Public references consist of a technical disclosure on Medium that details the injection vector alongside other issues in PHPJabbers products, together with the vendor product page; neither source describes an official patch or mitigation steps. The associated EPSS score stands at 0.4727 with no subsequent increase reported.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-45302
Vulnerability details
PHPJabbers Food Delivery Script v3.0 is vulnerable to SQL Injection in the "column" parameter of index.php.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.