PT-2024-21373 · Unknown · Bdtask Wholesale Inventory Management System

Srivishnu · Published 2024-03-19 · Updated 2024-05-17 · CVE-2024-2639

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Bdtask Wholesale Inventory Management System versions up to 20240311

Description A vulnerability was found in the system, affecting an unknown functionality, which leads to session fixiation. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Recommendations For versions up to 20240311, as a temporary workaround, consider implementing additional security measures to prevent session fixation attacks, such as regenerating session IDs after a successful login. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Session Fixation

Weakness Enumeration

CWE-384

Related Identifiers

CVE-2024-2639

Affected Products

Bdtask Wholesale Inventory Management System

References · 6

• 🔥 https://drive.google.com/file/d/1bNnSNssAeQFkO0FdW_yaEvDg5XExMPaf/view?usp=drivesdk · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-2639 · Security Note
• https://twitter.com/CVEnew/status/1770107087240233049 · Twitter Post
• https://vuldb.com/?ctiid.257245 · Note
• https://vuldb.com/?id.257245 · Note
• https://t.me/cvenotify/74252 · Telegram Post