High severity · published Feb 18, 2023
CVE-2023-0905
SourceCodester Employee Task Management System changePasswordForEmployee.php improper authentication
7.5
CVSS
3.2%
EPSS
No
On KEV
Description
A vulnerability classified as critical has been found in SourceCodester Employee Task Management System 1.0. Affected is an unknown function of the file changePasswordForEmployee.php. The manipulation leads to improper authentication. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-221454 is the identifier assigned to this vulnerability.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.2% · higher than 88% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ET
Employee Task Management System · SourceCodester
1.0 · source: vendor, NVD
Affected product
ET
Employee Task Management System
SourceCodester
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-0905
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-0905
Exploit
https://github.com/navaidzansari/CVE_Demo/blob/main/2023/Employee%20Task%20Management%20System%20-%20Broken%20Authentication.md
Permissions Required
https://vuldb.com/?ctiid.221454
Permissions Required
https://vuldb.com/?id.221454
More from Employee Task Management System
9.8
CVE-2024-2577
SourceCodester Employee Task Management System update-employee.php authorization
9.8
CVE-2024-2576
SourceCodester Employee Task Management System update-admin.php authorization
9.8
CVE-2024-2575
SourceCodester Employee Task Management System task-details.php authorization
9.8
CVE-2024-2574
SourceCodester Employee Task Management System edit-task.php authorization
9.8
CVE-2024-2573
SourceCodester Employee Task Management System task-info.php redirect