CVE-2023-49968

The Customer Support System v1 is vulnerable to a SQL injection vulnerability in the /customer_support/manage_department.php page. The root cause is a lack of validation for the id parameter, which allows an attacker to execute arbitrary SQL commands on the MySQL database. This can be exploited t...

CVE-2023-49544

The Customer Support System v1 is vulnerable to a Local File Inclusion (LFI) flaw via the page= parameter at /customer_support/index.php. An authenticated user can manipulate this parameter to include and read internal PHP files from the operating system, such as db_connect. Evidence shows that a...

CVE-2023-49545

Customer Support System v1 is affected by a directory listing vulnerability that allows unauthenticated attackers to view directories and sensitive files. Specifically, accessing paths such as /customer_support/database/ or /customer_support/assets/ can expose important application files. The vul...

CVE-2023-49546

The Customer Support System v1 is vulnerable to a SQL injection vulnerability (CWE-89) via the email parameter at the /customer_support/ajax.php endpoint. The root cause is a lack of proper validation for externally entered SQL statements during the save_staff operation, specifically when creatin...

CVE-2023-49548

Customer Support System v1 is vulnerable to a SQL injection vulnerability (CWE-89) due to a lack of proper validation of the lastname parameter. An attacker can exploit this by sending malicious payloads to the /customer_support/ajax.php?action=save_user endpoint when creating or editing a user p...

CVE-2023-49547

The Customer Support System v1 is vulnerable to a SQL injection vulnerability due to a lack of validation on the username parameter at the /customer_support/ajax.php?action=login endpoint. This flaw allows unauthenticated remote attackers to bypass authentication by injecting malicious SQL statem...

CVE-2023-49969

The Customer Support System v1 is susceptible to a SQL injection vulnerability due to a lack of validation on the id parameter at the /customer_support/index.php?page=edit_customer endpoint. An attacker can manipulate this URL parameter to execute unauthorized SQL commands against the MySQL datab...

CVE-2023-49970

Customer Support System v1 is vulnerable to a SQL injection vulnerability due to a lack of validation on the subject parameter at the /customer_support/ajax.php?action=save_ticket endpoint. An attacker can execute arbitrary SQL commands against the MySQL database, potentially leading to the theft...

CVE-2023-49974

Customer Support System v1 is vulnerable to a stored cross-site scripting (XSS) vulnerability due to the application's lack of effective filtering and escaping of user-supplied data. An attacker can inject a crafted payload into the contact field or parameter when creating or editing a customer. ...

CVE-2023-49977

A stored cross-site scripting (XSS) vulnerability exists in Customer Support System v1 due to the application's lack of effective filtering and escaping of user-supplied data. Attackers can inject a crafted payload into the Address field or parameter when creating or editing a customer. This payl...

CVE-2023-49976

A stored cross-site scripting (XSS) vulnerability exists in Customer Support System v1 due to insufficient filtering and escaping of user-supplied data. An attacker can inject a crafted payload into the subject parameter when creating or editing a ticket at /customer_support/index.php?page=new_ti...

CVE-2023-49971

CVE-2023-49971 describes a cross-site scripting (XSS) vulnerability in the Customer Support System v1, exploitable via a crafted payload injected into the firstname parameter at /customer_support/index.php?page=customer_list. Multiple connected sources (NVD, Red Hat, CNVD, CVE List, CNVD CNVD, PR...

CVE-2023-49973

CVE-2023-49973 is a documented cross-site scripting (XSS) vulnerability in the open-source-like Customer Support System v1 . The issue stems from insufficient input validation/escaping in the parameter email used at the endpoint /customer_support/index.php?page=customer_list, allowing attackers t...

CVE-2023-51281

The Customer Support System v.1.0 is vulnerable to a Cross-Site Scripting (XSS) vulnerability. Authenticated attackers can execute arbitrary web scripts or HTML by injecting a manipulated payload into the firstname , lastname , middlename , contact , or address parameters via the /customer_suppor...

CVE-2023-49978

CVE-2023-49978 concerns an improper access control in the Customer Support System v1, where non-administrator users can access administrative pages and perform actions reserved for admins. Documents confirm the affected software and root cause as insufficient access restrictions on admin interfac...

CVE-2023-50070

CVE-2023-50070 affects Sourcecodester Customer Support System 1.0. It reports multiple SQL injection vulnerabilities in the endpoint /customer_support/ajax.php?action=save_ticket, exploitable via the parameters department_id , customer_id , and subject . The consolidated sources describe the vuln...

CVE-2025-40729

CVE-2025-40729 affects Customer Support System v1.0; a reflected XSS in /customer_support/index.php via the page parameter enables remote attackers to run arbitrary code. Public sources (NVD/Red Hat/CVE lists) confirm the vulnerability and its impact as described; exploitation details, affected v...

CVE-2025-40728

CVE-2025-40728 affects Customer Support System v1.0. SQL injection via the id parameter in /customer_support/manage_user.php enables an authenticated attacker to retrieve, create, update, and delete databases. The advisories describe high impact (confidentiality/integrity/availability) with low a...

CVE-2025-70141

The SourceCodester Customer Support System 1.0 is vulnerable to an incorrect access control flaw in the ajax.php file. The AJAX dispatcher fails to enforce authentication or authorization before invoking administrative methods in admin_class.php based on the action parameter. This allows an unaut...