PT-2024-15589 · Unknown · Code-Projects Dormitory Management System

Firepunch · Published 2024-01-12 · Updated 2024-10-24 · CVE-2024-0472

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions code-projects Dormitory Management System version 1.0

Description A vulnerability was found in the code-projects Dormitory Management System, affecting some unknown processing of the file modifyuser.php. The manipulation of the argument mname leads to information disclosure. The exploit has been disclosed to the public and may be used.

Recommendations For code-projects Dormitory Management System version 1.0, consider restricting access to the modifyuser.php file until a patch is available. As a temporary workaround, avoid using the mname argument in the affected file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Information Disclosure

Insertion into Log File

Weakness Enumeration

CWE-200

CWE-532

Related Identifiers

CVE-2024-0472

Affected Products

Code-Projects Dormitory Management System

References · 9

• 🔥❌ https://github.com/yingqian1984/FirePunch/blob/main/7-Dormitory%20Management%20System%20has%20Database%20information%20leakage%20modifyuser.php.pdf · Exploit, Deleted
• https://osv.dev/vulnerability/CVE-2024-0472 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-0472 · Security Note
• https://twitter.com/CVEnew/status/1745923023624900819 · Twitter Post
• https://t.me/cvenotify/99386 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1745954293671252280 · Twitter Post
• https://vuldb.com/?id.250577 · Note
• https://vuldb.com/?ctiid.250577 · Note
• https://t.me/cvenotify/67998 · Telegram Post