PT-2024-4332 · Unknown · Daily Expenses Management System
Ayush Patidar
·
Published
2024-03-12
·
Updated
2025-06-20
·
CVE-2024-29390
CVSS v3.1
7.3
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L |
Name of the Vulnerable Software and Affected Versions
Daily Expenses Management System version 1.0
Description
The Daily Expenses Management System contains a time-based blind SQL injection vulnerability in the 'add-expense.php' page. An attacker can exploit the
item parameter in a POST request to execute arbitrary SQL commands in the backend database. This can be done by injecting specially crafted SQL queries that make the database perform time-consuming operations, thereby confirming the presence of the SQL injection vulnerability based on the delay in the server's response.Recommendations
As a temporary workaround, consider disabling the
item parameter in the 'add-expense.php' page until a patch is available.
Restrict access to the 'add-expense.php' page to minimize the risk of exploitation.
Avoid using the item parameter in the affected API endpoint until the issue is resolved.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
SQL injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Daily Expenses Management System