PT-2024-16567 · Code Projects · Code-Projects E-Health Care System

Xueweian

·

Published

2024-11-04

·

Updated

2024-11-09

·

CVE-2024-10809

CVSS v3.1

7.5

High

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions code-projects E-Health Care System version 1.0
Description A critical issue affects some unknown processing of the file /Doctor/chat.php. The manipulation of the arguments name and message leads to sql injection. The attack may be initiated remotely.
Recommendations For code-projects E-Health Care System version 1.0, update to the latest version immediately to mitigate risks. As a temporary workaround, consider restricting access to the /Doctor/chat.php file until a patch is available. Avoid using the parameters name and message in the affected API endpoint until the issue is resolved.

Exploit

Fix

Improper Neutralization

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-707CWE-74CWE-89

Related Identifiers

CVE-2024-10809

Affected Products

Code-Projects E-Health Care System