PT-2024-17147 · Unknown · Code-Projects Simple Car Rental System

Silen · Published 2024-11-23 · Updated 2024-11-25 · CVE-2024-11632

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions code-projects Simple Car Rental System version 1.0

Description A critical issue has been found in the code-projects Simple Car Rental System. The problem is related to an unknown function of the file /book car.php, where the manipulation of the arguments fname, id no, gender, email, phone, and location can lead to SQL injection. This issue can be exploited remotely. The initial advisory mentioned the parameter fname as affected, but further analysis suggests other arguments might also be vulnerable.

Recommendations For code-projects Simple Car Rental System version 1.0, consider disabling the /book car.php file or restricting access to it until a patch is available. As a temporary workaround, avoid using the parameters fname, id no, gender, email, phone, and location in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-74

CWE-89

Related Identifiers

CVE-2024-11632

Affected Products

Code-Projects Simple Car Rental System

References · 11

• 🔥 https://github.com/sil3n/cve/issues/2 · Exploit
• 🔥 https://github.com/sil3n/cve · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-11632 · Security Note
• https://osv.dev/vulnerability/CVE-2024-11632 · Vendor Advisory
• https://vuldb.com/?submit.446308 · Note
• https://twitter.com/CVEnew/status/1860347959315169509 · Twitter Post
• https://t.me/latest_high_impact_cve/1554 · Telegram Post
• https://vuldb.com/?ctiid.285918 · Note
• https://vuldb.com/?id.285918 · Note
• https://t.me/cvenotify/102441 · Telegram Post
• https://code-projects.org · Note