Description
thesystem App 1.0 contains a SQL injection vulnerability that allows attackers to bypass authentication by manipulating the username parameter. Attackers can inject malicious SQL code like ' or '1=1 to the username field to gain unauthorized access to user accounts.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| kostasmitroglou | thesystem | 1.0 | — |
References
- ExploitDB-47432 exploit
- Vendor GitHub Repository product
- VulnCheck Advisory: thesystem App 1.0 - 'username' SQL Injection third-party-advisory