PT-2024-20424 · Unknown · Employee Management System

Published 2024-02-08 · Updated 2024-04-24 · CVE-2024-24499

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Employee Management System version 1.0

Description The issue allows a remote attacker to execute arbitrary SQL commands via the txtfullname and txtphone parameters in the "edit profile.php" component.

Recommendations For Employee Management System version 1.0, consider restricting access to the edit profile.php component until a patch is available. As a temporary workaround, avoid using the txtfullname and txtphone parameters in the affected component to minimize the risk of exploitation.

Exploit

Related Identifiers

CVE-2024-24499

Affected Products

Employee Management System

References · 7

• 🔥 https://github.com/0xQRx/VulnerabilityResearch/blob/master/2024/EmployeeManagementSystem-SQL_Injection_Admin_Update_Profile.md · Exploit
• 🔥 https://exploit-db.com/exploits/51950 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-24499 · Security Note
• https://twitter.com/VulmonFeeds/status/1755746616932233449 · Twitter Post
• https://t.me/cvenotify/70674 · Telegram Post
• https://twitter.com/CVEnew/status/1755704252180365742 · Twitter Post
• https://t.me/cvenotify/71039 · Telegram Post