Vulnerability Details CVE-2018-19654
An issue was discovered in Sales & Company Management System (SCMS) through 2018-06-06. There is a discrepancy in username checking between a component that does string validation, and a component that is supposed to query a MySQL database. Thus, it is possible to register a new account with a duplicate username, as demonstrated by use of the test%c2 string when a test account already exists.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 46.7%
CVSS Severity
CVSS v3 Score 7.5
CVSS v2 Score 5.0
Products affected by CVE-2018-19654
-
cpe:2.3:a:sales_&_company_management_system_project:sales_&_company_management_system:-
-
cpe:2.3:a:sales_&_company_management_system_project:sales_&_company_management_system:2018-06-06