PT-2024-34483 · Unknown · Sourcecodester Simple Inventory System

Rocker · Published 2024-05-18 · Updated 2025-02-10 · CVE-2024-5098

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: SourceCodester Simple Inventory System version 1.0

Description: A critical issue has been found in the SourceCodester Simple Inventory System, affecting an unknown functionality of the file login.php. The manipulation of the username argument leads to SQL injection. The exploit has been disclosed to the public and may be used.

Recommendations: For SourceCodester Simple Inventory System version 1.0, update the system to a newer version that contains a fix for this issue. As a temporary workaround, consider restricting access to the login.php file or disabling the SQL injection vulnerability in the username argument until a patch is available. Avoid using the username argument in the affected login.php file until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-5098

Affected Products

Sourcecodester Simple Inventory System

References · 10

• 🔥 https://github.com/rockersiyuan/CVE/blob/main/SourceCodester%20Simple%20Inventory%20System%20Sql%20Inject-1.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-5098 · Security Note
• https://osv.dev/vulnerability/CVE-2024-5098 · Vendor Advisory
• https://vuldb.com/?submit.337056 · Note
• https://t.me/cvenotify/110551 · Telegram Post
• https://twitter.com/linuxpatch/status/1792089158539739483 · Twitter Post
• https://vuldb.com/?id.265081 · Note
• https://t.me/cvenotify/80371 · Telegram Post
• https://vuldb.com/?ctiid.265081 · Note
• https://twitter.com/CVEnew/status/1792076969636483221 · Twitter Post