PT-2024-30038 · Unknown · Warehouse Inventory System

Topsky979 · Published 2024-08-20 · Updated 2024-08-21 · CVE-2024-42577

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Warehouse Inventory System version 2.0

Description A Cross-Site Request Forgery (CSRF) in the component add product.php of Warehouse Inventory System allows attackers to escalate privileges.

Recommendations For Warehouse Inventory System version 2.0, consider implementing proper CSRF token validation in the add product.php component to prevent privilege escalation attacks. As a temporary workaround, restrict access to the add product.php component until a patch is available.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2024-42577

Affected Products

Warehouse Inventory System

References · 7

• 🔥 https://gist.github.com/topsky979/20ad7b251f2905db38e7a6566b1d46cc · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-42577 · Security Note
• https://osv.dev/vulnerability/CVE-2024-42577 · Vendor Advisory
• https://t.me/cvenotify/91538 · Telegram Post
• https://t.me/cvedetector/3622 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1825923821473288517 · Twitter Post
• https://twitter.com/CVEnew/status/1825885294828335588 · Twitter Post