PT-2024-2042 · Unknown · Keerti1924 Php-Mysql-User-Login-System

Joshua Lictan + 1 · Published 2024-03-07 · Updated 2025-03-11 · CVE-2024-2264

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions keerti1924 PHP-MYSQL-User-Login-System version 1.0

Description The issue is related to the lack of protection against SQL query structure exploitation in the /login.php component of the user registration and login system. This can allow a remote attacker to gain unauthorized access to the application. The manipulation of the email argument leads to SQL injection. The attack can be launched remotely.

Recommendations For keerti1924 PHP-MYSQL-User-Login-System version 1.0, consider disabling the /login.php component until a patch is available to prevent SQL injection attacks. Restrict access to the email argument in the /login.php endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2024-01920

CVE-2024-2264

Affected Products

Keerti1924 Php-Mysql-User-Login-System

References · 9

• 🔥❌ https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/keerti1924%20PHP-MYSQL-User-Login-System/SQLI%20Auth.md · Exploit, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2024-2264 · Security Note
• https://osv.dev/vulnerability/CVE-2024-2264 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-01920 · Security Note
• https://github.com/keerti1924/PHP-MYSQL-User-Login-System · Note
• https://twitter.com/CVEnew/status/1765848460220158116 · Twitter Post
• https://t.me/cvenotify/114288 · Telegram Post
• https://vuldb.com/?ctiid.256034 · Note
• https://vuldb.com/?id.256034 · Note