Cyber Resilience

CVE-2023-50071

HighPublic PoC

Published: 29 December 2023

Published
29 December 2023
Modified
21 November 2024
KEV Added
—
Patch
—
CVSS Score v3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.1107 93.6th percentile
Risk Priority 24 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-50071 is a high-severity SQL Injection (CWE-89) vulnerability in Customer Support System Project Customer Support System. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked in the top 6.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

Sourcecodester Customer Support System 1.0 contains multiple SQL injection vulnerabilities in the /customer_support/ajax.php?action=save_department endpoint that can be triggered through the id or name parameters. The flaw is tracked as CWE-89 and received a CVSS 3.1 score of 8.8 reflecting network attack vector, low complexity, and low required privileges.

An authenticated attacker with low privileges can supply crafted input to execute arbitrary SQL commands against the backend database, resulting in full read, write, or deletion of data and potential escalation to system-level impact. The current and peak EPSS score is 0.1107 with no material rise observed after disclosure.

Public references consist of a GitHub repository and accompanying Medium write-up that reproduce the injection vectors, but no vendor advisory, patch information, or mitigation steps are included in the available details.

EU & UK References

Vulnerability details

Sourcecodester Customer Support System 1.0 has multiple SQL injection vulnerabilities in /customer_support/ajax.php?action=save_department via id or name.

CWE(s)
CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
attack.mitre.org →
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1213.006 Databases Collection
Adversaries may leverage databases to mine valuable information.
attack.mitre.org →
Why these techniques?

SQL injection allows arbitrary SQL execution, enabling exploitation of public-facing web apps (T1190), data from local files via LOAD_FILE (T1005), and database queries (T1213.006).

Affected Assets

customer support system project
customer support system
1.0

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

CA-8 Penetration Testing
addresses: CWE-89

Penetration testing uses SQL injection payloads against database interfaces, identifying and supporting fixes for SQL injection weaknesses.

SI-10 Information Input Validation
addresses: CWE-89

Validates query inputs to prevent SQL syntax or command manipulation.

References