PT-2024-25756 · Sourcecodester · Sourcecodester Stock Management System

Dovankha · Published 2024-05-13 · Updated 2024-08-22 · CVE-2024-34226

Positive Technologies (AI Summary)

CVSS v3.1

9.4

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions SourceCodester Visitor Management System version 1.0

Description The issue allows attackers to execute arbitrary SQL commands, potentially leading to data exfiltration. This can be exploited remotely via the id parameter in the "/php-sqlite-vms/?page=manage visitor&id=1" API endpoint.

Recommendations For SourceCodester Visitor Management System version 1.0, patch immediately and validate input to prevent exploitation. As a temporary workaround, consider restricting access to the "/php-sqlite-vms/?page=manage visitor&id=1" endpoint and validating the id parameter to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-34226

Affected Products

Sourcecodester Stock Management System

References · 4

• 🔥 https://github.com/dovankha/CVE-2024-34226 · Exploit
• https://osv.dev/vulnerability/CVE-2024-34226 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-34226 · Security Note
• https://twitter.com/oktsec/status/1809998206845014444 · Twitter Post