PT-2024-38584 · Unknown · Sourcecodester Task Progress Tracker

Joinia · Published 2024-08-14 · Updated 2024-08-20 · CVE-2024-7792

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SourceCodester Task Progress Tracker version 1.0

Description A critical issue has been found in the software, allowing for SQL injection. The manipulation of the task argument in the /endpoint/delete-task.php file leads to this issue. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. An attacker can remotely delete tasks.

Recommendations For SourceCodester Task Progress Tracker version 1.0, consider disabling the /endpoint/delete-task.php endpoint until a patch is available. Restrict access to this endpoint to minimize the risk of exploitation. Avoid using the task argument in the affected endpoint until the issue is resolved. Validate user input to prevent SQL injection attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-7792

Affected Products

Sourcecodester Task Progress Tracker

References · 12

• 🔥 https://github.com/joinia/webray.com.cn/blob/main/Task-Progress-Tracker/Task-Progress-Trackersql.md · Exploit
• https://osv.dev/vulnerability/CVE-2024-7792 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-7792 · Security Note
• https://t.me/cvedetector/3197 · Telegram Post
• https://t.me/cvenotify/91403 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1824013596294070392 · Twitter Post
• https://vuldb.com/?ctiid.274560 · Note
• https://vuldb.com/?id.274560 · Note
• https://vuldb.com/?submit.389360 · Note
• https://twitter.com/CVEnew/status/1823806280563351829 · Twitter Post
• https://twitter.com/oktsec/status/1825113972065890730 · Twitter Post
• https://t.me/cvenotify/90714 · Telegram Post