PT-2024-37776 · Sourcecodester · Sourcecodester Employee/Visitor Gate Pass Logging System

Xu Mingming · Published 2024-07-10 · Updated 2024-10-17 · CVE-2024-6649

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions SourceCodester Employee and Visitor Gate Pass Logging System version 1.0

Description A vulnerability has been found in the system, classified as problematic. The issue affects the save users function of the Users.php file, leading to cross-site request forgery. The attack can be launched remotely.

Recommendations For SourceCodester Employee and Visitor Gate Pass Logging System version 1.0, consider disabling the save users function of the Users.php file as a temporary workaround until a patch is available. Restrict access to the Users.php file to minimize the risk of exploitation.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2024-6649

Affected Products

Sourcecodester Employee/Visitor Gate Pass Logging System

References · 9

• 🔥 https://github.com/Xu-Mingming/cve/blob/main/csrf1.md · Exploit
• https://osv.dev/vulnerability/CVE-2024-6649 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-6649 · Security Note
• https://vuldb.com/?ctiid.271057 · Note
• https://vuldb.com/?id.271057 · Note
• https://vuldb.com/?submit.370663 · Note
• https://twitter.com/VulmonFeeds/status/1811136139329257680 · Twitter Post
• https://t.me/cvedetector/571 · Telegram Post
• https://twitter.com/CVEnew/status/1811322713103045020 · Twitter Post