CVE-2023-49546

Customer Support System v1 was discovered to contain a SQL injection vulnerability via the email parameter at /customersupport/ajax.php...

CVE-2023-49969

Customer Support System v1 was discovered to contain a SQL injection vulnerability via the id parameter at /customersupport/index.php?page=editcustomer...

CVE-2023-49968

Customer Support System v1 was discovered to contain a SQL injection vulnerability via the id parameter at /customersupport/managedepartment.php...

CVE-2023-49546: Improper Neutralization of Special Elements used in an SQL Command

Customer Support System v1 was discovered to contain a SQL injection vulnerability via the email parameter at /customersupport/ajax.php...

CVE-2023-49547: Improper Neutralization of Special Elements used in an SQL Command

Customer Support System v1 was discovered to contain a SQL injection vulnerability via the username parameter at /customersupport/ajax.php?action=login...

CVE-2023-49968

Customer Support System v1 was discovered to contain a SQL injection vulnerability via the id parameter at /customersupport/managedepartment.php...

CVE-2023-49547

The Customer Support System v1 is vulnerable to a SQL injection vulnerability due to a lack of validation on the username parameter at the /customer_support/ajax.php?action=login endpoint. This flaw allows unauthenticated remote attackers to bypass authentication by injecting malicious SQL statem...

CVE-2023-49547

Customer Support System v1 was discovered to contain a SQL injection vulnerability via the username parameter at /customersupport/ajax.php?action=login...

CVE-2023-49968

The Customer Support System v1 is vulnerable to a SQL injection vulnerability in the /customer_support/manage_department.php page. The root cause is a lack of validation for the id parameter, which allows an attacker to execute arbitrary SQL commands on the MySQL database. This can be exploited t...

CVE-2023-49548: Improper Neutralization of Special Elements used in an SQL Command

Customer Support System v1 was discovered to contain a SQL injection vulnerability via the lastname parameter at /customersupport/ajax.php?action=saveuser...

CVE-2023-49547

Customer Support System v1 was discovered to contain a SQL injection vulnerability via the username parameter at /customersupport/ajax.php?action=login...

CVE-2023-49969

The Customer Support System v1 is susceptible to a SQL injection vulnerability due to a lack of validation on the id parameter at the /customer_support/index.php?page=edit_customer endpoint. An attacker can manipulate this URL parameter to execute unauthorized SQL commands against the MySQL datab...

CVE-2023-49968: Improper Neutralization of Special Elements used in an SQL Command

Customer Support System v1 was discovered to contain a SQL injection vulnerability via the id parameter at /customersupport/managedepartment.php...

CVE-2023-49970

Customer Support System v1 was discovered to contain a SQL injection vulnerability via the subject parameter at /customersupport/ajax.php?action=saveticket...

CVE-2023-49969: Improper Neutralization of Special Elements used in an SQL Command

Customer Support System v1 was discovered to contain a SQL injection vulnerability via the id parameter at /customersupport/index.php?page=editcustomer...

CVE-2023-49546

The Customer Support System v1 is vulnerable to a SQL injection vulnerability (CWE-89) via the email parameter at the /customer_support/ajax.php endpoint. The root cause is a lack of proper validation for externally entered SQL statements during the save_staff operation, specifically when creatin...

CVE-2023-49548

Customer Support System v1 was discovered to contain a SQL injection vulnerability via the lastname parameter at /customersupport/ajax.php?action=saveuser...

CVE-2023-49970: Improper Neutralization of Special Elements used in an SQL Command

Customer Support System v1 was discovered to contain a SQL injection vulnerability via the subject parameter at /customersupport/ajax.php?action=saveticket...

CVE-2023-49545

A directory listing vulnerability in Customer Support System v1 allows attackers to list directories and sensitive files within the application without requiring authorization...

CVE-2023-49544

A local file inclusion LFI in Customer Support System v1 allows attackers to include internal PHP files and gain unauthorized acces via manipulation of the page= parameter at /customersupport/index.php...