PT-2024-27776 · Unknown · Itsourcode Learning Management System

Chenshan + 9 · Published 2024-06-17 · Updated 2025-06-10 · CVE-2024-37840

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Itsourcecode Learning Management System Project In PHP With Source Code version 1.0

Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the LessonID parameter in the processscore.php file.

Recommendations For Itsourcecode Learning Management System Project In PHP With Source Code version 1.0, consider restricting access to the processscore.php file until a patch is available, and avoid using the LessonID parameter in this file to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-37840

Affected Products

Itsourcode Learning Management System

References · 4

• 🔥 https://github.com/ganzhi-qcy/cve/issues/4 · Exploit
• https://osv.dev/vulnerability/CVE-2024-37840 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-37840 · Security Note
• https://t.me/cvenotify/125311 · Telegram Post