PT-2024-19932 · Unknown · Keerti1924 Secret-Coder-Php-Project

Reiginald · Published 2024-03-10 · Updated 2024-05-17 · CVE-2024-2355

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions keerti1924 Secret-Coder-PHP-Project version 1.0

Description A vulnerability has been found in the keerti1924 Secret-Coder-PHP-Project, affecting an unknown functionality of the file /secret coder.sql. The manipulation leads to the inclusion of sensitive information in the source code. The attack can be launched remotely, with a rather high complexity and difficult exploitation. The exploit has been disclosed to the public and may be used.

Recommendations For keerti1924 Secret-Coder-PHP-Project version 1.0, consider restricting access to the /secret coder.sql file to minimize the risk of exploitation. As a temporary workaround, avoid using the affected functionality until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-540

Related Identifiers

CVE-2024-2355

Affected Products

Keerti1924 Secret-Coder-Php-Project

References · 6

• 🔥 https://github.com/smurf-reigz/security/blob/main/proof-of-concepts/keerti1924%20%5BSecret-Coder-PHP-Project%20Sensitive%20Information%20Disclosure%5D%20on%20secret_coder.sql.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-2355 · Security Note
• https://vuldb.com/?ctiid.256315 · Note
• https://t.me/cvenotify/73449 · Telegram Post
• https://vuldb.com/?id.256315 · Note
• https://twitter.com/CVEnew/status/1766790550173421634 · Twitter Post