CVE-2023-49641

critical

Description

Billing Software v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'username' parameter of the loginCheck.php resource does not validate the characters received and they are sent unfiltered to the database.

References

https://www.kashipara.com/

https://fluidattacks.com/advisories/zimerman/

https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-53583

Details

Source: Mitre, NVD

Published: 2025-05-13

Updated: 2026-04-15

Risk Information

CVSS v2

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Severity: Critical

CVSS v3

Base Score: 9.8

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H