PT-2024-20596 · Unknown · Surya2Developer Hostel Management Service

Blackslim3 + 1 · Published 2024-03-15 · Updated 2024-05-17 · CVE-2024-2483

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Surya2Developer Hostel Management Service version 1.0

Description A problematic issue has been found in the Password Change Handler component, specifically affecting the /change-password.php file. The manipulation of the oldpassword argument leads to cross-site request forgery. This issue can be initiated remotely.

Recommendations For Surya2Developer Hostel Management Service version 1.0, consider disabling the password change functionality in the /change-password.php file until a patch is available. Restrict access to the Password Change Handler component to minimize the risk of exploitation. Avoid using the oldpassword argument in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2024-2483

Affected Products

Surya2Developer Hostel Management Service

References · 6

• 🔥 https://github.com/blackslim3/cve_sidequest/blob/main/poc/CSRF%20on%20Hostel%20Management%20System%20using%20PHP%20and%20MySQL%201.0.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-2483 · Security Note
• https://t.me/cvenotify/73872 · Telegram Post
• https://vuldb.com/?id.256889 · Note
• https://vuldb.com/?ctiid.256889 · Note
• https://twitter.com/CVEnew/status/1768538895925252437 · Twitter Post