4 matches found
CVE-2021-35337
SourceCodester Phone Shop Sales Management System 1.0 is vulnerable to Insecure Direct Object Reference (IDOR). The root cause is improper access control that lets an attacker change the id parameter to view invoices of other users. Reported across multiple sources (NVD entry CVE-2021-35337; CNVD...
CVE-2021-36624
The CVE describes a remote SQL injection in Sourcecodester Phone Shop Sales Managements System v1.0 that enables authentication bypass. Affected component: the PHP-based login/authentication logic; root cause: SQL injection in authentication flow. Impact per sources ranges to partial/full confide...
CVE-2021-36623
CVE-2021-36623 affects Sourcecodester Phone Shop Sales Management System 1.0 (PHP). The vulnerability is an arbitrary file upload that leads to remote code execution. The connected sources confirm the affected product and the root cause (unrestricted file upload). There are citations indicating e...