Security readout for executives and security teams
Plain-English summary
RecipePoint 1.9 has a remotely reachable SQL injection in the recipe search/result function. If an organization runs this product, an attacker with required access may be able to interfere with application data or availability. The source bundle does not identify a patch, workaround, or confirmed active exploitation.
Executive priority
Prioritize if RecipePoint 1.9 is public-facing or stores sensitive customer, recipe, or account data. If the product is not deployed, no action is needed beyond asset confirmation.
Technical view
CVE-2023-3984 affects phpscriptpoint RecipePoint 1.9 at /recipe-result. Manipulation of text, category, type, difficulty, cuisine, or cooking_method can lead to SQL injection. CVSS v2 is 6.5 with network access, low complexity, single authentication, and partial confidentiality, integrity, and availability impact.
Likely exposure
Exposure is limited to organizations running phpscriptpoint RecipePoint 1.9, especially internet-accessible instances exposing /recipe-result. The CVSS vector indicates authentication is required, but the attack can be initiated remotely.
Exploitation context
The bundle says remote attack is possible, but it does not cite public exploitation, exploit use in the wild, or CISA KEV listing. Treat exploit status as unconfirmed from the provided evidence.
Researcher notes
The affected code location is described as an unknown part of /recipe-result. Sources do not name a vendor patch, fixed version, or mitigation. Analysis should avoid assuming unauthenticated exposure because the CVSS vector lists single authentication.
Mitigation direction
- Inventory any RecipePoint deployments and confirm whether version 1.9 is present.
- Check phpscriptpoint or hosting-provider guidance for any update or workaround.
- Restrict access to /recipe-result where business use allows.
- Apply WAF or application filtering for suspicious search parameter abuse.
- Review SQL query handling for parameterized queries if maintaining the code.
Validation and detection
- Confirm whether /recipe-result is exposed on each RecipePoint instance.
- Verify the installed RecipePoint version from application files or admin metadata.
- Review logs for unusual requests involving affected recipe search parameters.
- Assess database error logs for injection-related failures or abnormal query patterns.
- Use authorized, non-destructive testing to confirm remediation only in controlled environments.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-89: Database access and collection lookup
Injection into data stores can inform collection, data access, and exfiltration detection reviews. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupDatabase behavior lookup
The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2023-3984 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.5 (2.0)
- Known Exploited
- No
- Published
Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
AV:N/AC:L/Au:S/C:P/I:P/A:P86.4Primary CVE scoreVulnerability scoring details
Base CVSS 2.0 score
6.5MediumVector: AV:N/AC:L/Au:S/C:P/I:P/A:P
Source materials
- CVE List V5 sourceCVE List V5
- https://vuldb.com/?id.235605CVE reference · vdb-entry, technical-description
- https://vuldb.com/?ctiid.235605CVE reference · signature
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.