PT-2024-33155 · Unknown · Best Courier Management System

Published 2024-10-25 · Updated 2025-05-02 · CVE-2024-48580

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Best courier management system in php version 1.0

Description The issue allows a remote attacker to execute arbitrary code via the email parameter of the "login request" API endpoint. This enables the attacker to inject malicious SQL code, potentially leading to unauthorized access or data manipulation.

Recommendations For version 1.0, consider validating and sanitizing the email parameter in the login request to prevent SQL injection attacks. As a temporary workaround, restrict access to the login functionality until a proper fix is implemented.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-48580

Affected Products

Best Courier Management System

References · 5

• 🔥 https://github.com/baineoli/CVE/blob/main/2024/courier%20management%20system%20-%20SQL%20Injection%20%28Admin%20Login%29.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-48580 · Security Note
• https://osv.dev/vulnerability/CVE-2024-48580 · Vendor Advisory
• https://t.me/cvenotify/120688 · Telegram Post
• https://t.me/cvedetector/8951 · Telegram Post