PT-2024-34480 · Unknown · Itsourcecode Online Furniture Shopping Project

Akhlak2511 · Published 2024-11-13 · Updated 2024-11-18 · CVE-2024-50970

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Itsourcecode Online Furniture Shopping Project version 1.0

Description: A SQL injection issue in orderview1.php allows remote attackers to execute arbitrary SQL commands via the id parameter. This enables attackers to manipulate database queries, potentially leading to unauthorized data access or modification.

Recommendations: For Itsourcecode Online Furniture Shopping Project version 1.0, consider disabling the orderview1.php file or restricting access to it until a patch is available. Avoid using the id parameter in the affected orderview1.php file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-50970

Affected Products

Itsourcecode Online Furniture Shopping Project

References · 9

• 🔥 https://github.com/Akhlak2511/CVE-2024-50970 · Exploit
• https://osv.dev/vulnerability/CVE-2024-50970 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-50970 · Security Note
• https://t.me/cvedetector/10835 · Telegram Post
• https://t.me/cvenotify/102049 · Telegram Post
• https://twitter.com/CVEnew/status/1856726595119055128 · Twitter Post
• https://itsourcecode.com/free-projects/php-project/online-furniture-shop-in-php-projects-free-source-code-and-database · Note
• https://twitter.com/VulmonFeeds/status/1856756982868283484 · Twitter Post
• https://t.me/cvenotify/101705 · Telegram Post