PT-2024-16779 · Unknown · Code-Projects Job Recruitment

Li_12138 · Published 2024-11-12 · Updated 2024-11-15 · CVE-2024-11127

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions code-projects Job Recruitment version 1.0

Description A critical issue has been found in the code-projects Job Recruitment software. The problem affects an unknown functionality of the file admin.php. The manipulation of the userid argument leads to SQL injection. This issue can be exploited remotely. There is a potential for unauthenticated remote code execution via the userid in admin.php.

Recommendations For code-projects Job Recruitment version 1.0, patch immediately and review logs for signs of exploitation. As a temporary workaround, consider restricting access to the admin.php file to minimize the risk of exploitation. Avoid using the userid argument in the affected functionality until the issue is resolved.

Exploit

Fix

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-74

CWE-89

Related Identifiers

CVE-2024-11127

Affected Products

Code-Projects Job Recruitment

References · 11

• 🔥 https://github.com/ljllll123/cve/blob/main/sql-1.md · Exploit
• https://osv.dev/vulnerability/CVE-2024-11127 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-11127 · Security Note
• https://twitter.com/CVEnew/status/1856355648658911649 · Twitter Post
• https://vuldb.com/?submit.441841 · Note
• https://twitter.com/oktsec/status/1856270129933287552 · Twitter Post
• https://vuldb.com/?id.283975 · Note
• https://vuldb.com/?ctiid.283975 · Note
• https://code-projects.org · Note
• https://t.me/cvedetector/10634 · Telegram Post
• https://t.me/cvenotify/101396 · Telegram Post