High severity · published Sep 9, 2023
CVE-2023-4846
SourceCodester Simple Membership System delete_member.php sql injection
7.5
CVSS
0.6%
EPSS
No
On KEV
Description
A vulnerability was found in SourceCodester Simple Membership System 1.0. It has been rated as critical. This issue affects some unknown processing of the file delete_member.php. The manipulation of the argument mem_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-239255.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 49% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SM
Simple Membership System · SourceCodester
1.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-4846
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-4846
Exploit
https://github.com/Swpan2018/Vulhub/blob/main/Simple-Membership-System%20delete_member.php%20has%20Sqlinjection.pdf
Permissions Required
https://vuldb.com/?ctiid.239255
Third Party Advisory
https://vuldb.com/?id.239255
More from Simple Membership System
9.8
CVE-2023-5260
SourceCodester Simple Membership System group_validator.php sql injection
9.8
CVE-2023-4845
SourceCodester Simple Membership System account_edit_query.php sql injection
7.5
CVE-2023-5027
SourceCodester Simple Membership System club_validator.php sql injection
7.5
CVE-2023-4844
SourceCodester Simple Membership System club_edit_query.php sql injection