Vulnerability · Published Feb 22, 2023 · Assigned by VulDB

CVE-2023-0963SourceCodester Music Gallery Site POST Request Users.php access control

High 7.3

In plain English

A high-severity improper access control in Music Gallery Site from SourceCodester. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 4.7% (higher than 92% of all known vulnerabilities).

Severity (CVSS 3.1)7.3High

Exploit odds (30 days)4.7%top 8.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was found in SourceCodester Music Gallery Site 1.0. It has been rated as critical. This issue affects some unknown processing of the file Users.php of the component POST Request Handler. The manipulation leads to improper access controls. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-221633 was assigned to this vulnerability.

Affected products (as reported)

Vendor	Product	Versions
SourceCodester	Music Gallery Site	1.0

Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

References

https://vuldb.com/?id.221633 vdb-entry
https://vuldb.com/?ctiid.221633 signature, permissions-required
https://github.com/navaidzansari/CVE_Demo/blob/main/2023/Music%20Gallery%20Site%20-%20Broken%20Access%20Control.md exploit