PT-2024-15458 · Unknown · Kashipara Dynamic Lab Management System

Vista_Ax · Published 2024-01-08 · Updated 2024-05-17 · CVE-2024-0307

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Kashipara Dynamic Lab Management System versions up to 1.0

Description A critical vulnerability has been found in the Kashipara Dynamic Lab Management System. The issue affects unknown code in the file login process.php. The manipulation of the password argument leads to SQL injection. This attack can be initiated remotely.

Recommendations For versions up to 1.0, as a temporary workaround, consider restricting access to the login process.php file until a patch is available. Avoid using the password argument in the affected file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-0307

Affected Products

Kashipara Dynamic Lab Management System

References · 9

• 🔥 https://github.com/VistaAX/vulnerablility/blob/main/Dynamic%20Lab%20Management%20System%20-%20vuln%202.pdf · Exploit
• https://osv.dev/vulnerability/CVE-2024-0307 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-0307 · Security Note
• https://twitter.com/CVEnew/status/1744296005774758214 · Twitter Post
• https://twitter.com/cracbot/status/1745899715257086018 · Twitter Post
• https://t.me/cvenotify/66573 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1744322553030578593 · Twitter Post
• https://vuldb.com/?ctiid.249874 · Note
• https://vuldb.com/?id.249874 · Note