PT-2024-34481 · Unknown · Itsourcecode Construction Management System

Akhlak2511 · Published 2024-11-13 · Updated 2024-11-18 · CVE-2024-50971

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Itsourcecode Construction Management System version 1.0

Description: A SQL injection issue in the print.php file allows remote attackers to execute arbitrary SQL commands via the map id parameter. This enables attackers to potentially extract or modify sensitive data. The issue can be exploited by sending crafted requests to the vulnerable endpoint, allowing for unauthorized access to database resources.

Recommendations: For Itsourcecode Construction Management System version 1.0, consider disabling the print.php file or restricting access to it until a patch is available. Avoid using the map id parameter in the affected API endpoint until the issue is resolved. As a temporary workaround, restrict access to the print.php file to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-50971

Affected Products

Itsourcecode Construction Management System

References · 9

• 🔥 https://github.com/Akhlak2511/CVE-2024-50971 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-50971 · Security Note
• https://osv.dev/vulnerability/CVE-2024-50971 · Vendor Advisory
• https://t.me/cvedetector/10836 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1856782583511535664 · Twitter Post
• https://itsourcecode.com/free-projects/php-project/construction-management-system-project-in-php-with-source-code · Note
• https://twitter.com/CVEnew/status/1856726596385710465 · Twitter Post
• https://t.me/cvenotify/101706 · Telegram Post
• https://twitter.com/oktsec/status/1856753482868400542 · Twitter Post