PT-2024-17786 · Unknown · 1000 Projects Attendance Tracking Management System

Murray

·

Published

2024-12-23

·

Updated

2025-01-08

·

CVE-2024-12899

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions 1000 Projects Attendance Tracking Management System version 1.0
Description A critical issue affects the processing of the file /admin/course action.php. The manipulation of the course code argument leads to SQL injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
Recommendations For version 1.0, consider disabling access to the /admin/course action.php file until a patch is available. Restrict the manipulation of the course code argument to minimize the risk of SQL injection exploitation. Avoid using the course code argument in the affected file until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-74CWE-89

Related Identifiers

CVE-2024-12899

Affected Products

1000 Projects Attendance Tracking Management System