PT-2024-16738 · Unknown · Itsourcecode Tailoring Management System

Dimengshi · Published 2024-11-11 · Updated 2024-11-15 · CVE-2024-11074

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions itsourcecode Tailoring Management System version 1.0

Description A critical vulnerability was found in the itsourcecode Tailoring Management System, affecting the file /incadd.php. The manipulation of the arguments inccat, desc, date, and amount leads to SQL injection. The attack can be initiated remotely.

Recommendations As a temporary workaround, consider restricting access to the vulnerable file /incadd.php until a patch is available. Avoid using the parameters inccat, desc, date, and amount in the affected API endpoint until the issue is resolved. Update to the latest release to mitigate risks. Review input validation on all parameters to prevent similar issues.

Exploit

Fix

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-74

CWE-89

Related Identifiers

CVE-2024-11074

Affected Products

Itsourcecode Tailoring Management System

References · 22

• 🔥 https://github.com/dimongshi/cve/issues/1 · Exploit
• https://osv.dev/vulnerability/CVE-2024-11074 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-11074 · Security Note
• https://twitter.com/transilienceai/status/1857478674909638747 · Twitter Post
• https://vuldb.com/?ctiid.283870 · Note
• https://twitter.com/transilienceai/status/1857478680689426434 · Twitter Post
• https://twitter.com/transilienceai/status/1857291875822018931 · Twitter Post
• https://vuldb.com/?id.283870 · Note
• https://t.me/cvenotify/101300 · Telegram Post
• https://twitter.com/transilienceai/status/1857291897053622384 · Twitter Post
• https://twitter.com/oktsec/status/1855922837871063297 · Twitter Post
• https://twitter.com/CVEnew/status/1856032025528111346 · Twitter Post
• https://twitter.com/transilienceai/status/1857478669306048925 · Twitter Post
• https://twitter.com/transilienceai/status/1857478694442512878 · Twitter Post
• https://t.me/cvenotify/101730 · Telegram Post