cve/2023/CVE-2023-4407.md

### [CVE-2023-4407](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-4407)
![](https://img.shields.io/static/v1?label=Product&message=Credit%20Lite&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3D%201.5.4%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-89%20SQL%20Injection&color=brighgreen)

### Description

A vulnerability classified as critical was found in Codecanyon Credit Lite 1.5.4. Affected by this vulnerability is an unknown functionality of the file /portal/reports/account_statement of the component POST Request Handler. The manipulation of the argument date1/date2 leads to sql injection. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-237511.

### POC

#### Reference
- http://packetstormsecurity.com/files/174244/Credit-Lite-1.5.4-SQL-Injection.html

#### Github
- https://github.com/shankarsimi9/Apple.Remote.crash