PT-2024-20422 · Unknown · Employee Management System

Published 2024-02-08 · Updated 2024-04-24 · CVE-2024-24497

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Employee Management System version 1.0

Description The issue allows a remote attacker to execute arbitrary SQL commands via the txtusername and txtpassword parameters in the "login.php" component. This enables the attacker to manipulate the database, potentially leading to unauthorized access or data modification.

Recommendations For Employee Management System version 1.0, consider disabling the login functionality until a patch is available, or restrict access to the "login.php" component to minimize the risk of exploitation. Avoid using the txtusername and txtpassword parameters in the affected component until the issue is resolved.

Exploit

Related Identifiers

CVE-2024-24497

Affected Products

Employee Management System

References · 7

• 🔥 https://exploit-db.com/exploits/51951 · Exploit
• 🔥 https://github.com/0xQRx/VulnerabilityResearch/blob/master/2024/EmployeeManagementSystem-SQL_Injection_Admin_Login.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-24497 · Security Note
• https://t.me/cvenotify/70672 · Telegram Post
• https://t.me/cvenotify/71037 · Telegram Post
• https://twitter.com/CVEnew/status/1755701615259164883 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1755746363768209737 · Twitter Post