Vulnerability · Published Sep 25, 2023 · Assigned by mitre

CVE-2023-43457

Critical 9.8

In plain English

A critical-severity privilege mismanagement in the affected software. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 72% of all known vulnerabilities).

Severity (CVSS NVD)9.8Critical

Exploit odds (30 days)1.4%top 28.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

An issue in Service Provider Management System v.1.0 allows a remote attacker to gain privileges via the ID parameter in the /php-spms/admin/?page=user/ endpoint.

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

Weakness: CWE-269

References

https://www.sourcecodester.com/users/tips23
https://www.sourcecodester.com/php/16501/service-provider-management-system-using-php-and-mysql-source-code-free-download.html
https://samh4cks.github.io/posts/cve-2023-43457/