PT-2024-38701 · Unknown · Itsourcecode Project Expense Monitoring System

Guotingting · Published 2024-08-19 · Updated 2024-09-03 · CVE-2024-7936

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: itsourcecode Project Expense Monitoring System version 1.0

Description: A critical vulnerability has been found in the itsourcecode Project Expense Monitoring System. This issue affects an unknown part of the file transferred report.php. The manipulation of the arguments start, end, and employee leads to SQL injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Recommendations: For itsourcecode Project Expense Monitoring System version 1.0, consider disabling the transferred report.php file or restricting access to it until a patch is available. As a temporary workaround, avoid using the arguments start, end, and employee in the affected file to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-7936

Affected Products

Itsourcecode Project Expense Monitoring System

References · 11

• 🔥 https://github.com/DeepMountains/zzz/blob/main/CVE3-4.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-7936 · Security Note
• https://osv.dev/vulnerability/CVE-2024-7936 · Vendor Advisory
• https://vuldb.com/?submit.392948 · Note
• https://t.me/cvenotify/91210 · Telegram Post
• https://t.me/cvedetector/3576 · Telegram Post
• https://vuldb.com/?id.275121 · Note
• https://t.me/cvenotify/93103 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1825786961254056307 · Twitter Post
• https://twitter.com/CVEnew/status/1825679169289650627 · Twitter Post
• https://vuldb.com/?ctiid.275121 · Note