PT-2024-15420 · Sourcecodester · Sourcecodester Engineers Online Portal

Ahmed8199 · Published 2024-01-06 · Updated 2024-05-17 · CVE-2024-0260

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions SourceCodester Engineers Online Portal version 1.0

Description A problematic vulnerability was found in the Password Change component of the SourceCodester Engineers Online Portal. The issue affects an unknown function of the file change password teacher.php and leads to session expiration. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Recommendations For version 1.0, consider restricting access to the change password teacher.php file until a patch is available. As a temporary workaround, avoid using the Password Change component to minimize the risk of exploitation.

Exploit

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2024-0260

Affected Products

Sourcecodester Engineers Online Portal

References · 9

• 🔥 https://mega.nz/file/yEsSwK6D#--ygVt0NtzhZdqVxvjaPLCYfnIeBSyf76KaRozOxfVo · Exploit
• https://osv.dev/vulnerability/CVE-2024-0260 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-0260 · Security Note
• https://twitter.com/VulmonFeeds/status/1743805457020465353 · Twitter Post
• https://t.me/cvenotify/66961 · Telegram Post
• https://twitter.com/CVEnew/status/1743802510031163718 · Twitter Post
• https://vuldb.com/?ctiid.249816 · Note
• https://vuldb.com/?id.249816 · Note
• https://t.me/cvenotify/66491 · Telegram Post