CVE-2023-44755

The application does not properly validate or filter input data passed in the password parameter during database queries. An attacker can inject malicious SQL code directly into the query executed by the /sacco/ajax.php endpoint. This allows manipulation of database query logic without needing authentication.

An attacker can gain unauthorized access to data stored in the database, including confidential and authentication data, and in certain configurations may also modify or delete data and potentially take control of the database system.

Apply patches available from the vendor according to references. Additionally, it is recommended to implement parameterized SQL queries (prepared statements) and strict server-side input validation. Until the patch is applied, it is recommended to restrict access to the /sacco/ajax.php endpoint at the firewall or WAF level.

Mayurik Sacco Management System v1.0