CVE-2023-0562

Description

A vulnerability was found in PHPGurukul Bank Locker Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file index.php of the component Login. The manipulation of the argument username leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-219716.

Overview

State: PUBLISHED
Assigner (CNA): VulDB
CVSS severity: HIGH
CVSS score: 7.3 / 10
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Effective score: 7.3 / 10 HIGH source: CNA overview
CWE(s): CWE-89
Reserved: 2023-01-28
Published: 2023-01-28 23:23 UTC
Last updated: 2024-11-25 17:30 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/0xxx/CVE-2023-0562.json
Linked Threat: CVE-2023-0562 — PHPGurukul Bank Locker Management System Login index.php sql injection

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published: 2023-01-28 23:15:08 UTC
NVD last modified: 2026-06-17 05:25:49 UTC
NVD CVSS v3.1: 7.3 / 10 HIGH source: cna@vuldb.com
NVD CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Exploitability subscore: 3.9 / 10
Impact subscore: 3.4 / 10
EPSS score: 0.4427 (probability of exploitation in next 30 days)
EPSS percentile: 98.60% vs all CVEs — higher = more likely to be exploited, as of 2026-06-30

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2023-12607
Assigner: VulDB
Published: Jan 28, 2023, 10:23:53 PM
Updated: Nov 25, 2024, 4:30:46 PM
EUVD base score (CVSS 3.1): 7.3 / 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
EUVD-reported EPSS: 84.4500
Vendors: PHPGurukul
Products: Bank Locker Management System (1.0)
Aliases: GHSA-969h-25hq-6mxh

ENISA description: A vulnerability was found in PHPGurukul Bank Locker Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file index.php of the component Login. The manipulation of the argument username leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-219716.

EUVD references (3)

Affected products (1)

Vendor	Product	Versions	Platforms
PHPGurukul	Bank Locker Management System	`1.0` (affected)	—

Affected products — CPE 2.3 (1) NVD

NVD's normalized CPE 2.3 matchers, used by vendor tools (vulnerability scanners, asset managers) for automated detection. Compare with the CNA's free-text "Affected products" section above.

cpe:2.3:a:phpgurukul:bank_locker_management_system:1.0:*:*:*:*:*:*:*

Vendor references (3)

References embedded in the original CVE record by the assigning CNA.

https://vuldb.com/?id.219716 vdb-entrytechnical-description
https://vuldb.com/?ctiid.219716 signaturepermissions-required
https://github.com/ctflearner/Vulnerability/blob/main/Bank_Locker_Management_System/Bank%20Locker%20Management%20System-SQL%20.md exploit

MITRE references (3) cveawg.mitre.org

Pulled from MITRE's CVE Services API by the 🛰 Backfill from MITRE button.

https://github.com/ctflearner/Vulnerability/blob/main/Bank_Locker_Management_System/Bank%20Locker%20Management%20System-SQL%20.md exploit
https://vuldb.com/?ctiid.219716 signature, permissions-required
https://vuldb.com/?id.219716 vdb-entry, technical-description

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

NVD-tagged references (6)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

https://github.com/ctflearner/Vulnerability/blob/main/Bank_Locker_Management_System/Bank%20Locker%20Management%20System-SQL%20.md cna@vuldb.com ExploitThird Party Advisory
https://github.com/ctflearner/Vulnerability/blob/main/Bank_Locker_Management_System/Bank%20Locker%20Management%20System-SQL%20.md af854a3a-2127-422b-91ae-364da2661108 ExploitThird Party Advisory
https://vuldb.com/?ctiid.219716 cna@vuldb.com Permissions Required
https://vuldb.com/?ctiid.219716 af854a3a-2127-422b-91ae-364da2661108 Permissions Required
https://vuldb.com/?id.219716 cna@vuldb.com Third Party Advisory
https://vuldb.com/?id.219716 af854a3a-2127-422b-91ae-364da2661108 Third Party Advisory

Indicators (1)

IOCs linked to the auto-promoted Threat row.

Type	Value	VirusTotal	Attached
domain	`index.php`	no local data	2026-05-18 21:20 UTC

Remediations (15)

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

Microsoft Releases KB5089573 for Windows 11 to Fix Patch Tuesday ...

web:cybersecuritynews.com

Microsoft has rolled out a new cumulative update, KB5089573, for Windows 11 versions 25H2 and 24H2, targeting a critical installation failure that affected users following the May 2026 Patch Tuesday release.

2026-06-02 00:49 UTC
Microsoft Patch Tuesday, December 2025 Edition - Krebs on Security

web:krebsonsecurity.com

Microsoft today pushed updates to fix at least 56 security flaws in its Windows operating systems and supported software. This final Patch Tuesday of 2025 tackles one zero-day bug that is already ...

2026-06-02 00:49 UTC
February's Patch Tuesday release fixes 59 flaws ... - Computerworld

web:www.computerworld.com

Each month, the team at Readiness analyzes the latest Patch Tuesday updates from Microsoft and provides detailed, actionable testing guidance. The company's Patch Tuesday release for February ...

2026-06-02 00:49 UTC
Microsoft Patch Tuesday - November 2025 - Lansweeper

web:www.lansweeper.com

Which vulnerabilities, issues, and other things did Microsoft update? Discover what's new using Lansweeper's Patch Tuesday November 2025 summary.

2026-06-02 00:49 UTC
Patch Tuesday - November 2025 - Rapid7

web:www.rapid7.com

Microsoft is publishing 66 new vulnerabilities today, which is far fewer than we've come to expect in recent months. However, the lone zero-day vulnerability this month demands attention.

2026-06-02 00:49 UTC
Microsoft's April patch puts Windows domain controllers into reboot ...

web:www.tomshardware.com

Installing this month's Windows Server security update has knocked some enterprise domain controllers into continuous reboot cycles, Microsoft confirmed in a release health dashboard entry.

2026-05-22 05:35 UTC
CVE: Common Vulnerabilities and Exposures

web:www.cve.org

At cve .org, we provide the authoritative reference method for publicly known information-security vulnerabilities and exposures

2026-05-22 05:35 UTC
VirusTotal - Home

web:www.virustotal.com

VirusTotal is a platform for scanning files and URLs for viruses, malware, and other threats using multiple antivirus engines.

2026-05-22 05:35 UTC
Microsoft confirms new BitLocker bug in latest Windows and Server ...

web:www.notebookcheck.net

Microsoft confirmed that its April 2026 security updates, including KB5082063 and KB5083769, are triggering BitLocker recovery prompts on some Windows Server 2025, Windows 11, and Windows 10 devices.

2026-05-22 05:35 UTC
Oracle Critical Patch Update Advisory - April 2026

web:www.oracle.com

This Critical Patch Update contains 481 new security patches across the product families listed below. Please note that an MOS note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at April 2026 Critical Patch Update: Executive Summary and Analysis.

2026-05-22 05:35 UTC
Patch Tuesday May 2026: Security Updates & CVE Analysis

web:zecurit.com

Get the complete breakdown of Microsoft's May 2026 Patch Tuesday. We analyze the latest security updates and all critical CVEs .

2026-05-22 05:35 UTC
Microsoft Releases Out-of-Band Patch to Fix Critical RRAS RCE ...

web:cybersecuritynews.com

Microsoft released an out-of-band hotpatch update on March 13, 2026, addressing serious security vulnerabilities in Windows 11 versions 24H2 and 25H2.

2026-05-22 05:35 UTC
Microsoft Issues Massive Windows Patch for 160+ Bugs ... - TechRepublic

web:www.techrepublic.com

Microsoft's April 2026 Patch Tuesday fixes 165 vulnerabilities, including two zero-days, in one of the company's largest monthly security updates.

2026-05-22 05:35 UTC
NVD - Home

web:nvd.nist.gov

The NVD is the U.S. government repository of standards based vulnerability management data represented using the Security Content Automation Protocol (SCAP). This data enables automation of vulnerability management, security measurement, and compliance. The NVD includes databases of security checklist references, security-related software flaws, product names, and impact metrics. For ...

2026-05-22 05:35 UTC
Security Update Guide - Microsoft

web:portal.msrc.microsoft.com

The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.

2026-05-22 05:35 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2023-0562.json.

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T05:17:49.900Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "technical-description",
              "x_transferred"
            ],
            "url": "https://vuldb.com/?id.219716"
          },
          {
            "tags": [
              "signature",
              "permissions-required",
              "x_transferred"
            ],
            "url": "https://vuldb.com/?ctiid.219716"
          },
          {
            "tags": [
              "exploit",
              "x_transferred"
            ],
            "url": "https://github.com/ctflearner/Vulnerability/blob/main/Bank_Locker_Management_System/Bank%20Locker%20Management%20System-SQL%20.md"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-0562",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-01-08T16:05:20.331261Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-25T16:30:46.500Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "Login"
          ],
          "product": "Bank Locker Management System",
          "vendor": "PHPGurukul",
          "versions": [
            {
              "status": "affected",
              "version": "1.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "analyst",
          "value": "Affan (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was found in PHPGurukul Bank Locker Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file index.php of the component Login. The manipulation of the argument username leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-219716."
        },
        {
          "lang": "de",
          "value": "Eine kritische Schwachstelle wurde in PHPGurukul Bank Locker Management System 1.0 ausgemacht. Es geht hierbei um eine nicht n\u00e4her spezifizierte Funktion der Datei index.php der Komponente Login. Mit der Manipulation des Arguments username mit unbekannten Daten kann eine sql injection-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk angegangen werden. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 7.5,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 SQL Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-20T19:45:42.568Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/?id.219716"
        },
        {
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/?ctiid.219716"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://github.com/ctflearner/Vulnerability/blob/main/Bank_Locker_Management_System/Bank%20Locker%20Management%20System-SQL%20.md"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2023-01-28T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2023-01-28T00:00:00.000Z",
          "value": "CVE reserved"
        },
        {
          "lang": "en",
          "time": "2023-01-28T01:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2023-02-25T08:47:51.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "PHPGurukul Bank Locker Management System Login index.php sql injection"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2023-0562",
    "datePublished": "2023-01-28T22:23:53.698Z",
    "dateReserved": "2023-01-28T16:12:24.338Z",
    "dateUpdated": "2024-11-25T16:30:46.500Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}