PT-2024-12026 · Sourcecodester · Sourcecodester Customer Relationship Management System

Momo1239 · Published 2024-05-14 · Updated 2025-04-22 · CVE-2023-24204

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SourceCodester Simple Customer Relationship Management System version 1.0

Description The issue allows an attacker to execute arbitrary code via the name parameter in the "get-quote.php" endpoint. This enables the attacker to potentially inject malicious SQL code, compromising the system's security.

Recommendations For SourceCodester Simple Customer Relationship Management System version 1.0, consider restricting access to the "get-quote.php" endpoint until a patch is available. As a temporary workaround, avoid using the name parameter in the affected endpoint to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2023-24204

Affected Products

Sourcecodester Customer Relationship Management System

References · 10

• 🔥 https://github.com/momo1239/CVE-2023-24203-and-CVE-2023-24204 · Exploit
• https://osv.dev/vulnerability/CVE-2023-24204 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-24204 · Security Note
• https://t.me/cvenotify/119402 · Telegram Post
• https://t.me/cvenotify/79747 · Telegram Post
• https://t.me/cvenotify/79746 · Telegram Post
• https://t.me/cvenotify/119401 · Telegram Post
• https://sourcecodester.com · Note
• https://momonguyen.com/2023/cve-2023-24203 · Note
• https://t.me/cvenotify/100941 · Telegram Post