CVE-2023-3878

Campcodes Beauty Salon Management System about-us.php sql injection

Published: Jul 25, 2023Updated: Nov 21, 2024 Sources: CVE List NVDCWE-89

6.3MEDIUM

Description

A vulnerability was found in Campcodes Beauty Salon Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/about-us.php. The manipulation of the argument pagedes leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-235240.

In plain language

AI Worth attention

Beauty Salon Management System 1.0 has a database-input flaw in its admin area, so businesses using it should restrict access and seek vendor guidance.

Executive summary

Authenticated remote SQL injection in Campcodes Beauty Salon Management System 1.0 via the pagedes parameter in /admin/about-us.php permits limited confidentiality, integrity, and availability impact.

If affected, business impact

Business data exposureUnauthorized database changesService disruption

What to do now

Confirm whether you run Beauty Salon Management System 1.0 and whether its admin area includes the About Us page.
Limit admin-area access to trusted staff and networks, and remove inactive administrator accounts.
No fixed version is currently available; ask the vendor for a security update or supported replacement.

May need vendor / contractor work

What is it

A weakness in the system’s About Us administration page can let an authorized attacker send specially crafted information to the underlying database. It is like giving someone with a staff key a malformed request that makes the filing cabinet return or alter records it should protect.

Who is affected

This matters to you if you run Beauty Salon Management System 1.0. It is only a risk if an attacker already has a login with access to the administration area.

How urgent is it

A public proof-of-concept gives attackers a starting point, but there is no evidence that this issue is being actively exploited. Treat this as an amber priority: reduce access now and obtain vendor guidance because no patch has been identified.

What to do — in detail

Confirm the installed product version and review whether /admin/about-us.php is present and reachable through the administrative interface. Review administrator accounts, recent admin logins, and web-server requests to that page for unusual pagedes parameter values.

There is no published fixed version or supported upgrade path. Until Campcodes provides one, restrict the admin interface to trusted networks or a VPN, enforce strong unique administrator credentials, remove unused accounts, and consider disabling access to the affected page if that can be done without disrupting operations.

Monitor vendor communications for a patch or replacement guidance and investigate unexpected database errors, unfamiliar administrator accounts, or unusual requests to /admin/about-us.php. CISA has not assigned a KEV remediation due date because this CVE is not listed in KEV.

Technical context

CVE-2023-3878 is CWE-89 SQL injection affecting unknown code in /admin/about-us.php, where manipulation of the pagedes argument is reported to trigger the flaw. CVSS v3.1 is 6.3 (Medium): AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, indicating remote exploitation after authentication with limited impact. A public GitHub PoC is known, but CISA KEV does not list the CVE and the findings provide no confirmed in-the-wild exploitation. EPSS is 0.6% (47th percentile) with a flat trend; this is a prediction, not evidence of exploitation. Exploit maturity is public PoC.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

CVSS Vector Breakdown

Exploitability

AV:NAttack Vector

Network

AC:LAttack Complexity

Low

PR:LPrivileges Required

Low

UI:NUser Interaction

None

Scope

S:UScope

Unchanged

Impact

C:LConfidentiality

Low

I:LIntegrity

Low

A:LAvailability

Low

Open in CVSS calculator →

Weaknesses

CWE-89

Affected Products

Campcodes

commercialaka complete web-based school management system, sales and inventory system, online job finder system

Beauty Salon Management SystemOn-premWeb App

Enterprise Software / itsm-monitoring

and 1 more affected products View all →

Exploitability

1 exploit source identified

Exploit details including PoC links, Metasploit modules, and scanner templates are available after registration.

View exploit details

Is your org exposed to CVE-2023-3878?Request an assessment to establish which checks are appropriate for your systems. Check my exposure

Attack Graph

Products CVE Techniques Tactics

Click technique nodes for MITRE ATT&CK details · drag to pan · Ctrl/⌘ + scroll to zoom, or go fullscreen.

MITRE ATT&CK

1 technique

Initial Access

View detailed technique mapping

References

https://vuldb.com/?id.235240

vuldb.com

https://vuldb.com/?ctiid.235240

vuldb.com

https://github.com/E1CHO/cve_hub/blob/main/Beauty%20Salon%20Management%20System/Beauty%20Salon%20Management%20System%20-%20vuln%2010.pdf

github.com

Unlock Complete Vulnerability Intelligence

Get the full picture for CVE-2023-3878 and every CVE in our database. Create a free account — no credit card required.

Create Free Account

Plain-language analysis

Impact assessment and exploitation scenario in plain English

Attack graph visualization

Interactive attack path and kill chain mapping

Exploit details & PoC links

ExploitDB, Metasploit, GitHub PoCs with direct links

Nuclei scanner templates

Ready-to-use vulnerability scanner templates

Full remediation guide

Patch instructions, workarounds, and compliance impact

Interactive AI chat

Ask questions about this vulnerability in natural language

Related vulnerabilities

Semantically similar CVEs and attack patterns

REST API & MCP access

Integrate vulnerability data into your workflows