PT-2024-31873 · Unknown · Projectworld Online Voting System

Sourajeet Majumder · Published 2024-09-26 · Updated 2024-10-05 · CVE-2024-45987

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Projectworld Online Voting System version 1.0

Description The issue allows an attacker to craft a malicious link that, when clicked by an authenticated user, automatically submits a vote for a specified party without the user's consent or knowledge. This is achieved via the voter.php page, leveraging the user's active session to perform the unauthorized action, compromising the integrity of the voting process.

Recommendations For Projectworld Online Voting System version 1.0, as a temporary workaround, consider disabling the voter.php page until a patch is available. Restrict access to the voter.php page to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2024-45987

Affected Products

Projectworld Online Voting System

References · 8

• 🔥 https://github.com/soursec/CVEs/tree/main/CVE-2024-45987 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-45987 · Security Note
• https://osv.dev/vulnerability/CVE-2024-45987 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1839410866342490577 · Twitter Post
• https://t.me/cvedetector/6452 · Telegram Post
• https://twitter.com/CVEnew/status/1839369794254188903 · Twitter Post
• https://t.me/cvenotify/97118 · Telegram Post
• https://twitter.com/oktsec/status/1839389115441099160 · Twitter Post