CVE-2023-3878

Campcodes Beauty Salon Management System about-us.php sql injection

Public exploit available. Not confirmed exploited in the wild yet. No fix published yet.

CVSS 3.16.3Medium EPSS percentile46th0.6% chance in 30 days CISA KEVNot listedNo confirmed exploitation
Public exploit: 1 source FixNone yetNo fix or workaround published

Published 2023-07-25Updated 2024-11-21Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Steps

Written by AI from the record

Confirm whether you run Beauty Salon Management System 1.0 and whether its admin area includes the About Us page.
Limit admin-area access to trusted staff and networks, and remove inactive administrator accounts.
No fixed version is currently available; ask the vendor for a security update or supported replacement.

May need vendor or contractor work

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

A vulnerability was found in Campcodes Beauty Salon Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/about-us.php. The manipulation of the argument pagedes leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-235240.

In plain language

Written by AI from the record

Beauty Salon Management System 1.0 has a database-input flaw in its admin area, so businesses using it should restrict access and seek vendor guidance.

Authenticated remote SQL injection in Campcodes Beauty Salon Management System 1.0 via the pagedes parameter in /admin/about-us.php permits limited confidentiality, integrity, and availability impact.

If you're affected

Business data exposure
Unauthorized database changes
Service disruption

What is it

A weakness in the system’s About Us administration page can let an authorized attacker send specially crafted information to the underlying database. It is like giving someone with a staff key a malformed request that makes the filing cabinet return or alter records it should protect.

Who is affected

This matters to you if you run Beauty Salon Management System 1.0. It is only a risk if an attacker already has a login with access to the administration area.

How urgent is it

A public proof-of-concept gives attackers a starting point, but there is no evidence that this issue is being actively exploited. Treat this as an amber priority: reduce access now and obtain vendor guidance because no patch has been identified.

What to do — in detail

Confirm the installed product version and review whether /admin/about-us.php is present and reachable through the administrative interface. Review administrator accounts, recent admin logins, and web-server requests to that page for unusual pagedes parameter values.

There is no published fixed version or supported upgrade path. Until Campcodes provides one, restrict the admin interface to trusted networks or a VPN, enforce strong unique administrator credentials, remove unused accounts, and consider disabling access to the affected page if that can be done without disrupting operations.

Monitor vendor communications for a patch or replacement guidance and investigate unexpected database errors, unfamiliar administrator accounts, or unusual requests to /admin/about-us.php. CISA has not assigned a KEV remediation due date because this CVE is not listed in KEV.

Technical context

CVE-2023-3878 is CWE-89 SQL injection affecting unknown code in /admin/about-us.php, where manipulation of the pagedes argument is reported to trigger the flaw. CVSS v3.1 is 6.3 (Medium): AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, indicating remote exploitation after authentication with limited impact. A public GitHub PoC is known, but CISA KEV does not list the CVE and the findings provide no confirmed in-the-wild exploitation. EPSS is 0.6% (47th percentile) with a flat trend; this is a prediction, not evidence of exploitation. Exploit maturity is public PoC.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS46th

Public exploit

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

1 source with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

0.6% chance of exploitation activity in the next 30 days, which ranks it in the 46th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

5 events over 955 days, from the signal feeds we watch.

2026-03-06Public exploit / PoCsource: github-poc
2024-11-21Record updated
2023-07-25Publishedweakness classified, att&ck mapped

Affected products

Campcodescommercialaka sales and inventory system, complete web-based school management system, online job finder system
- Beauty Salon Management SystemWeb AppOn-premEnterprise Software / itsm-monitoring

And 1 more affected product. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Scored 6.3 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required LowRequires basic user-level privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality LowSome restricted information is disclosed, but limited in scope
Integrity LowData modification is possible but limited in scope or consequence
Availability LowReduced performance or intermittent disruption of service