PT-2024-16679 · Unknown · Code-Projects E-Health Care System

Qqqbalabala · Published 2024-11-07 · Updated 2024-11-13 · CVE-2024-10987

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions code-projects E-Health Care System version 1.0

Description A critical issue was found in the code-projects E-Health Care System, affecting an unknown functionality of the file /Doctor/user appointment.php. The manipulation of the arguments schedule id, schedule date, schedule day, start time, end time, and booking leads to SQL injection. The attack can be launched remotely.

Recommendations For code-projects E-Health Care System version 1.0, patch immediately and validate input sanitization on the backend to prevent SQL injection attacks. As a temporary workaround, consider restricting access to the vulnerable file /Doctor/user appointment.php until a patch is available.

Exploit

Fix

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-74

CWE-89

Related Identifiers

CVE-2024-10987

Affected Products

Code-Projects E-Health Care System

References · 12

• 🔥 https://github.com/qqqbalabala/cve/blob/main/sql20.md · Exploit
• https://osv.dev/vulnerability/CVE-2024-10987 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-10987 · Security Note
• https://twitter.com/VulmonFeeds/status/1854785582100054076 · Twitter Post
• https://vuldb.com/?id.283453 · Note
• https://twitter.com/CVEnew/status/1854733445983092984 · Twitter Post
• https://vuldb.com/?submit.437351 · Note
• https://vuldb.com/?ctiid.283453 · Note
• https://t.me/cvenotify/101013 · Telegram Post
• https://t.me/cvedetector/10154 · Telegram Post
• https://twitter.com/oktsec/status/1854639497364853108 · Twitter Post
• https://code-projects.org · Note