{"id":"CVE-2023-7138","state":"PUBLISHED","title":"code-projects Client Details System HTTP POST Request admin sql injection","description":"A vulnerability, which was classified as critical, was found in code-projects Client Details System 1.0. This affects an unknown part of the file /admin of the component HTTP POST Request Handler. The manipulation of the argument username leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier VDB-249141 was assigned to this vulnerability.","publishedAt":"2023-12-28T22:00:05.688Z","updatedAt":"2025-04-17T20:27:36.136Z","severity":{"score":6.3,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","source":"VulDB"},"assigner":"VulDB","products":["code-projects Client Details System"],"affected":[{"vendor":"code-projects","product":"Client Details System","versions":[{"version":"1.0","status":"affected"}],"modules":["HTTP POST Request Handler"]}],"references":["https://vuldb.com/?id.249141","https://vuldb.com/?ctiid.249141","https://github.com/h4md153v63n/CVEs/blob/main/Client_Details_System/Client_Details_System-SQL_Injection_2.md"],"weaknesses":["CWE-89"],"ingestedAt":"2026-10-29T20:06:42.242Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/7xxx/CVE-2023-7138.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-7138","state":"PUBLISHED","datePublished":"2023-12-28T22:00:05.688Z","dateUpdated":"2025-04-17T20:27:36.136Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2023-12-28T08:22:50.128Z"},"containers":{"cna":{"title":"code-projects Client Details System HTTP POST Request admin sql injection","descriptions":[{"lang":"en","value":"A vulnerability, which was classified as critical, was found in code-projects Client Details System 1.0. This affects an unknown part of the file /admin of the component HTTP POST Request Handler. The manipulation of the argument username leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier VDB-249141 was assigned to this vulnerability."},{"lang":"de","value":"Es wurde eine kritische Schwachstelle in code-projects Client Details System 1.0 gefunden. Hiervon betroffen ist ein unbekannter Codeblock der Datei /admin der Komponente HTTP POST Request Handler. Mit der Manipulation des Arguments username mit unbekannten Daten kann eine sql injection-Schwachstelle ausgenutzt werden. Der Exploit steht zur öffentlichen Verfügung."}],"affected":[{"vendor":"code-projects","product":"Client Details System","versions":[{"version":"1.0","status":"affected"}],"modules":["HTTP POST Request Handler"]}],"references":[{"url":"https://vuldb.com/?id.249141","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.249141","tags":["signature","permissions-required"]},{"url":"https://github.com/h4md153v63n/CVEs/blob/main/Client_Details_System/Client_Details_System-SQL_Injection_2.md","tags":["exploit"]}],"metrics":[{"cvssV3_1":{"version":"3.1","baseScore":6.3,"vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseSeverity":"MEDIUM"}},{"cvssV3_0":{"version":"3.0","baseScore":6.3,"vectorString":"CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseSeverity":"MEDIUM"}},{"cvssV2_0":{"version":"2.0","baseScore":5.8,"vectorString":"AV:A/AC:L/Au:N/C:P/I:P/A:P"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-89","type":"CWE","lang":"en","description":"CWE-89 SQL Injection"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2023-12-28T22:00:05.688Z"},"timeline":[{"time":"2023-12-28T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2023-12-28T01:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2023-12-28T09:28:31.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"Hamdi Sevben (VulDB User)","type":"analyst"}]},"adp":[{"title":"CVE Program Container","references":[{"url":"https://vuldb.com/?id.249141","tags":["vdb-entry","technical-description","x_transferred"]},{"url":"https://vuldb.com/?ctiid.249141","tags":["signature","permissions-required","x_transferred"]},{"url":"https://github.com/h4md153v63n/CVEs/blob/main/Client_Details_System/Client_Details_System-SQL_Injection_2.md","tags":["exploit","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T08:50:08.194Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-01-08T16:28:54.530326Z","id":"CVE-2023-7138","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-04-17T20:27:36.136Z"}}]}}}