CVE-2023-51951 is a critical unauthenticated SQL injection in Stock Management System 1.0, a PHP and MySQL sample application, scored 9.8. The id parameter of manage_bo.php reaches a database query. The advisory lists no vendor fix, so use parameterised queries or retire the application.
What's affected
CVE-2023-51951 affects Stock Management System version 1.0, a PHP and MySQL application for shops and businesses, in the manage_bo.php file. NVD published it on 2024-02-05 with a score of 9.8 (critical) and the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
The researcher advisory from wizlynx group, dated 18 December 2023, lists affected versions as 1 and probably prior, vendor fix as N/A and status as open. It reports the same 9.8 score. One small difference: the advisory's table lists the scope as changed, while the NVD vector says scope unchanged. The score matches either way, so the practical rating is the same.
The NVD description says the flaw allows arbitrary code execution. The advisory describes SQL injection that allows data theft and wider database control. Code execution from SQL injection depends on the database setup, so plan for the second description and treat the first as a worst case.
The record's references include an Exploit-DB entry. That means public exploit material exists. It does not mean attacks were seen, and the KEV flag is false.
Weakness class: CWE-89.
How to check if you're exposed
Find out if you run this application. It is distributed as sample source code, so it may live in a web root under a name like sms, not under a product name. Search web servers for the file:
find /var/www -name manage_bo.php 2>/dev/null
Then look for how the id request value is used in that file. If it is concatenated into a SELECT statement, you have the flaw. Check web server access logs for requests to the file with unusual id values, such as very long values or ones containing quote characters.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan checks the open source packages you ship. It does not inspect appliance firmware or a vendor's closed product, so for this CVE the useful work is asset inventory and vendor follow-up.
What to do now
- Locate every copy of the application, including forgotten test servers.
- If it is in use, rewrite the query in manage_bo.php to use a prepared statement with a bound parameter, and review every other file for the same pattern, since the advisory says the code base was affected generally rather than in one place.
- Require authentication in front of the whole admin area, and restrict it by IP address.
- Give the database account used by the application the minimum rights it needs, and no file or administrative privileges.
- If it is a demo or learning project on an internet facing host, take it down.
Why it matters
This is CWE-89. The advisory shows the id value from the request placed directly into the text of a SQL query. When the database cannot tell data from instructions, the requester decides what the query does. A prepared statement keeps them apart and is the standard fix.
The deeper lesson is about sample projects. Code downloaded from tutorial and source sharing sites is often written to show a feature, not to survive hostile input, and then ends up running real shops. No vendor will ship a patch for it, so the fix is yours. The KEV flag is false and I found no report of attacks in the wild.
Quick check
Is there a patch for CVE-2023-51951?
The advisory lists the vendor fix as N/A and the status as open. Fix the code yourself or stop using the application.
Why does the record say code execution?
NVD uses that wording. The advisory describes SQL injection. Whether it reaches code execution depends on the database configuration, so assume the worse case and limit database privileges.
Sources
wizlynx group advisory WLX-2023-004 (fetched)
Exploit-DB entry 51990 (listed in the record, not fetched)
NVD record for CVE-2023-51951 (the record this guide is built from)
Last reviewed: 19 October 2026.
