CVE-2023-38890

Online Shopping Portal Project 3.1 allows remote attackers to execute arbitrary SQL commands/queries via the login form, leading to unauthorized access and potential data manipulation. This vulnerability arises due to insufficient validation of user-supplied input in the username field, enabling SQL Injection attacks.

CVSS v3.1

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

1.42% chance of exploitation in the next 30 days, 71th percentile

Published

2023-08-18

Updated

2025-12-08

Proof-of-concept exploits (3)

• akshadjoshi/CVE-2023-388900★ · 2023-08-18
• https://www.exploit-db.com/exploits/50029
• Tagoletta/CVE-2023-38890

References

• CVE Record
• NVD entry

Related

• CVE-2023-38888
• CVE-2023-3890
• CVE-2023-38886
• CVE-2023-38902
• CVE-2023-3888
• CVE-2023-38904