CVE-2022-40935

Online Pet Shop We App v1.0 is vulnerable to SQL Injection via /petshop/classes/Master.php?f=deletecategory,id...

Cross site scripting

A vulnerability has been found in SourceCodester Online Pet Shop We App 1.0 and classified as problematic. This vulnerability affects unknown code of the file /petshop/admin/orders/updatestatus.php. The manipulation of the argument oid with the input 1"alert1111 leads to cross site scripting. The...

CVE-2023-1042

SourceCodester Online Pet Shop We App 1.0 is affected via /pet_shop/admin/orders/update_status.php, where the oid parameter can be manipulated (e.g., 1">) to trigger cross-site scripting. Exploitation appears remote and widely disclosed. Affected component is the update_status endpoint; root c...

PT-2022-25153 · Unknown · Online Pet Shop We App

Name of the Vulnerable Software and Affected Versions: Online Pet Shop We App version 1.0 Description: The issue allows attackers to execute arbitrary code via a crafted PHP file uploaded through the picture upload point in the Editing function of the User module. This is achieved by exploiting a...

CVE-2022-41408

Online Pet Shop We App v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/?page=orders/vieworder...

CVE-2022-41407

CVE-2022-41407 affects Online Pet Shop We App v1.0, with a SQL injection vulnerability exploitable via the id parameter in /admin/?page=orders/view_order. CVSS 3.1 base score 7.2 (HIGH) with NETWORK attack vector, LOW complexity, HIGH privileges required, no user interaction, and impact to confid...

CVE-2022-41408

CVE-2022-41408 affects Online Pet Shop We App v1.0 with a SQL injection vulnerability in the id parameter of /admin/?page=orders/view_order. The CVSS 3.1 score is 9.8 (CRITICAL): network attack vector, no user interaction, no privileges required, with impact on confidentiality, integrity, and ava...

CVE-2022-40934

CVE-2022-40934 concerns Online Pet Shop We App v1.0 , with a reported SQL injection in the endpoint /pet_shop/classes/Master.php?f=delete_sub_category,id. The root cause is a lack of input validation/external SQL statement handling in the page parameter handling, enabling attackers to craft input...