CVE-2023-6440 SourceCodester Book Borrower System add-book.php cross site scripting

A vulnerability was found in SourceCodester Book Borrower System 1.0 and classified as problematic. This issue affects some unknown processing of the file endpoint/add-book.php. The manipulation of the argument Book Title/Book Author leads to cross site scripting. The attack may be initiated...

CVE-2023-6440

CVE-2023-6440 affects SourceCodester Book Borrower System 1.0. The vulnerability lies in the add-book.php endpoint where manipulating the Book Title/Book Author parameters enables cross-site scripting (XSS). Exploitation is remote and the issue has been publicly disclosed. Mitigation options docu...

PT-2023-32668 · Sourcecodester · Sourcecodester Book Borrower System

Name of the Vulnerable Software and Affected Versions: SourceCodester Book Borrower System version 1.0 Description: A vulnerability was found in the system, classified as problematic, affecting some unknown processing of the file "add-book.php". The manipulation of the argument Book Title or Book...

Loan Management System SQL Injection Vulnerability

Loan Management System is a loan management system by razormist individual developers. A SQL injection vulnerability exists in Loan Management System version 1.0, which stems from an incorrect manipulation of the parameter borrowerid that can lead to sql injection...

PT-2023-32610 · Sourcecodester · Sourcecodester Loan Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Loan Management System version 1.0 Description: A critical issue has been found in the system, affecting the delete borrower function of the deleteBorrower.php file. The manipulation of the borrower id argument leads to SQL...

Upgraded Q -> 2 from #19 [1700023001465]

Judge has assessed an item in Issue 19 as 2 risk. The relevant finding follows: Borrower can abuse enterMarkets to force liquidator can pay more fund --- The text was updated successfully, but these errors were encountered: All reactions...

Lender can cause unintended behavior for the borrower's transaction

Lines of code Vulnerability details This vulnerability comes in the form of when a borrower wants to remove a lender as a both deposit and withdraw and set them as a withdraw only, to avoid paying more interest on their funds in the market, this plan may not go as planned, based on the nature of...

InterestRate can be changed during close market.

Lines of code Vulnerability details Summary After closing market, the borrower can set the interest rate. Impact Breaking calculations, loss of funds. Vulnerability Details After borrower closed the market, he can set interest rate, this means remaining totalSupply still earn interest while it...

Borrower cannot change the maximum supply

Lines of code Vulnerability details Impact Maximum supply cannot be increased and by extension the max deposit limit too. Proof of Concept WildcatMarketConfig@setMaxTotalSupply is only callable by the WildcatMarketController but is not used anywhere there. WildcatMarketConfig.sol function...

Borrower escapes delinquency penalty if no intermittent action happens

Lines of code Vulnerability details Impact Once the market goes below required reserves, it is marked as delinquent only if an updateState action happens. Actions like market.updateState, executeWithdrawal, deposit, etc. have to happen else the protocol remains unaware of the market's delinquency...

Usury from simple mistake

Lines of code Vulnerability details Impact A borrower making a simple mistake might be forced to pay an extortionate interest rate for en extended period of time. Severity rating I was hovering between Medium and High on this one. Medium because it is based on a user mistake. On the other hand, t...

Interest accumulation linked to state updates may leak value

Lines of code Vulnerability details Impact The protocol compounds interest on every call that updates the state. This is an intentional design choice. However, this does mean that the total return for the lender, and, conversely, the cost of debt for the borrower, can be influenced by the frequen...

Early market adopters can force delinquency to game borrowers

Lines of code Vulnerability details Impact When new markets are created, a lender can call WildcatMarket.updateState. This will trigger a call to WildcatMarketBase.writeState, the check on line 449 state.liquidityRequired totalAssets will return false since totalAssets starts as 0. This will...

Borrower cannot close their market

Lines of code Vulnerability details The WildcatMarket::closeMarket cannot be executed by a borrower because the WildcatMarketController contract does not implement any function calling it. Proof of Concept The closeMarket is supposed to be called by a borrower to close their market, set the...

Liquidator can seize more tokens than the borrower has as collateral, leading to an arithmetic underflow and locking collateral.

Lines of code Vulnerability details Impact Lack of validation on seizeTokens could allow collateral locking by underflow. Proof of Concept The liquidateBorrowFresh function does not explicitly validate that seizeTokens is less than or equal to accountTokensborrower before transferring tokens from...

addCredit() DOS Attack

Lines of code Vulnerability details Impact DOS Attack Proof of Concept addCredit can be called by anyone, and the msg.value is as small as 1 wei. Users can modify Lien at a small cost, causing the value stored in lienslienId=keccak256abi.encodelien to change By front-run, the normal user's...

Lender can prevent borrower from returning NFT

Lines of code Vulnerability details Impact The lender can prevent the borrower of his NFT from returning it, forcing him to pay interest for longer. Proof of Concept The borrower returns the NFT owed by calling repayWithNftlien, lienId, tokenId. This will then validateLienlien, lienId which check...

DoS of auctionBuyNft()

Lines of code Vulnerability details Impact An auction can be forced to conclude, which is typically to the benefit of the lender. Proof of Concept auctionBuyNftlien, lienId, tokenId, amount validates the lien in question by validateLienlien, lienId which checks that the lien is hashed to the same...

Borrower cannot stop loss when fungibility breaks

Lines of code Vulnerability details Impact When the borrower cannot repay with NFT he will be forced to forsake his entire credit. This situation can be deliberately instigated by the lender. Proof of Concept A borrower can only leave his position by returning an NFT buyNftFromMarket or...

Borrower can block being defaulted or auctioned

Lines of code Vulnerability details Borrower can block being defaulted or auctioned The borrower can potentially block the liquidation and auction processed by using a contract and reverting on ETH transfers. Impact When a loan is being liquidated or auctioned, any credit still available to the...