PT-2020-15647 · Sourcecodester · Sourcecodester Daily Tracker System

Adeeb Shah + 3 · Published 2020-09-03 · Updated 2020-09-10 · CVE-2020-24193

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sourcecodetester Daily Tracker System version 1.0

Description A SQL injection issue in the login functionality allows an unauthenticated user to bypass authentication using SQL injection via the email parameter.

Recommendations For Sourcecodetester Daily Tracker System version 1.0, consider restricting access to the login functionality until a patch is available, and avoid using the email parameter in the affected API endpoint to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2020-24193

Affected Products

Sourcecodester Daily Tracker System

References · 4

• 🔥 https://exploit-db.com/exploits/48787 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-24193 · Security Note
• https://osv.dev/vulnerability/CVE-2020-24193 · Vendor Advisory
• http://sourcecodetester.com · Note