PT-2024-2041 · Unknown · Keerti1924 Php-Mysql-User-Login-System

Reiginald · Published 2024-03-07 · Updated 2024-05-17 · CVE-2024-2265

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions keerti1924 PHP-MYSQL-User-Login-System version 1.0

Description The issue is related to the disclosure of sensitive information through the source code of the login system. It affects an unknown part of the file login.sql. The manipulation can lead to the inclusion of sensitive information in the source code, and it is possible to initiate the attack remotely.

Recommendations For keerti1924 PHP-MYSQL-User-Login-System version 1.0, consider restricting access to the login.sql file to minimize the risk of exploitation. As a temporary workaround, review the source code for any sensitive information disclosure and remove or secure it until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-540

Related Identifiers

BDU:2024-01919

CVE-2024-2265

Affected Products

Keerti1924 Php-Mysql-User-Login-System

References · 9

• 🔥 https://github.com/smurf-reigz/security/blob/main/proof-of-concepts/keerti1924%20publicly%20exposed%20password%20hashes.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-2265 · Security Note
• https://bdu.fstec.ru/vul/2024-01919 · Security Note
• https://osv.dev/vulnerability/CVE-2024-2265 · Vendor Advisory
• https://github.com/keerti1924/PHP-MYSQL-User-Login-System · Note
• https://vuldb.com/?id.256035 · Note
• https://twitter.com/CVEnew/status/1765854504098943236 · Twitter Post
• https://vuldb.com/?ctiid.256035 · Note
• https://t.me/cvenotify/73315 · Telegram Post