PT-2024-38556 · Sourcecodester · Sourcecodester Accounts Manager App

Joinia · Published 2024-08-13 · Updated 2024-11-22 · CVE-2024-7748

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SourceCodester Accounts Manager App version 1.0

Description A critical issue has been found in the processing of the file "/endpoint/delete-account.php". The manipulation of the account argument leads to SQL injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. An attacker can delete accounts via the vulnerable "delete-account.php" endpoint.

Recommendations For SourceCodester Accounts Manager App version 1.0, patch immediately to prevent exploitation. Additionally, check logs for signs of exploit. As a temporary workaround, consider restricting access to the "/endpoint/delete-account.php" endpoint until a patch is available. Avoid using the account argument in the affected endpoint until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-7748

Affected Products

Sourcecodester Accounts Manager App

References · 10

• 🔥 https://github.com/joinia/webray.com.cn/blob/main/Accounts-Manager-App/Accounts-Manager-Appsql.md · Exploit
• https://osv.dev/vulnerability/CVE-2024-7748 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-7748 · Security Note
• https://t.me/cvedetector/3084 · Telegram Post
• https://twitter.com/CVEnew/status/1823477523503833586 · Twitter Post
• https://vuldb.com/?id.274367 · Note
• https://vuldb.com/?submit.389358 · Note
• https://vuldb.com/?ctiid.274367 · Note
• https://t.me/cvenotify/90415 · Telegram Post
• https://twitter.com/oktsec/status/1824947867162644922 · Twitter Post