CVE-2023-53734: dawa-pharma-1.0 - SQL Injection via Email Parameter

Deferred

Published 04-12-2025Last modified 07-04-2026

Vulnerability summary

CVE-2023-53734 is a high (CVSS 8.7) SQL Injection vulnerability in mayurik dawa-pharma. EPSS estimates a 0.53% chance of exploitation in the next 30 days, higher than 43.9% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk

45/100

0100

Medium · default modelHow is this calculated?

CVSS score

8.7/10

010

High · v4.0 (CVE.org)

EPSS score

0.53%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits1exploit-database

Timeline

04-12-2025
PublishedVulnerability first disclosed.
07-04-2026
Last modifiedVulnerability information updated.

Description

dawa-pharma-1.0 allows unauthenticated attackers to execute SQL queries on the server, allowing them to access sensitive information and potentially gain administrative access.

CVSS metrics

2 scores · 2 sources · 1 version

v4.08.7

EPSS trend

Probability

0.53%

Chance of exploitation in the next 30 days

Percentile

44%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.53% on 22-09-2026

22-09-202622-10-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found

exploit-databasephpUnverified
dawa-pharma 1.0-2022 - Multiple-SQLi
Maturity: poc

Weaknesses

CWE · root cause

CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Affected systems

Mayurik1 product

dawa-pharma1.0-2022

1 vendor · 1 product

References

5 links

www.exploit-db.com/exploits/51818Exploit
www.mayurik.com/source-code/P0349/best-pharmacy-billing-software-free-downloadProduct
github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/mayuri_k/2022/dawa-pharma-1.0-2022ProductIssue Tracking
www.nu11secur1ty.comProduct
www.vulncheck.com/advisories/dawa-pharma-10-sql-injection-via-email-parameterThird Party Advisory