PT-2024-38265 · Unknown · Itsourcecode Online Blood Bank Management System

Mdsmith49 · Published 2024-07-31 · Updated 2024-08-12 · CVE-2024-7320

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions itsourcecode Online Blood Bank Management System version 1.0

Description A critical vulnerability has been found in the itsourcecode Online Blood Bank Management System. This issue affects the /admin/index.php file of the Admin Login component. The manipulation of the user argument leads to SQL injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Recommendations For itsourcecode Online Blood Bank Management System version 1.0, patch the system immediately to prevent SQL injection attacks. Additionally, check for any potential compromise. As a temporary workaround, consider restricting access to the /admin/index.php endpoint until a patch is applied. Avoid using the user argument in the affected API endpoint until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-7320

Affected Products

Itsourcecode Online Blood Bank Management System

References · 10

• 🔥 https://github.com/cl4irv0yance/CVEs/issues/3 · Exploit
• https://osv.dev/vulnerability/CVE-2024-7320 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-7320 · Security Note
• https://t.me/cvedetector/2131 · Telegram Post
• https://vuldb.com/?ctiid.273231 · Note
• https://t.me/cvenotify/90142 · Telegram Post
• https://vuldb.com/?submit.383397 · Note
• https://twitter.com/oktsec/status/1822939657220313587 · Twitter Post
• https://vuldb.com/?id.273231 · Note
• https://t.me/cvenotify/88038 · Telegram Post