PT-2024-4407 · Unknown · Vehicle Management System

Hryspa_Hodor · Published 2024-06-16 · Updated 2024-08-01 · CVE-2024-6193

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Vehicle Management System version 1.0

Description The issue is related to the lack of protection against SQL query structure exploitation in the driverprofile.php file. This allows a remote attacker to execute arbitrary SQL code through the driverid parameter. The manipulation of the driverid argument leads to SQL injection. The attack may be initiated remotely.

Recommendations For Vehicle Management System version 1.0, consider disabling the driverid parameter in the driverprofile.php file until a patch is available. Restrict access to the driverprofile.php file to minimize the risk of exploitation. Avoid using the driverid parameter in the affected file until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2024-04906

CVE-2024-6193

Affected Products

Vehicle Management System

References · 9

• 🔥 https://github.com/HryspaHodor/CVE/issues/5 · Exploit
• https://bdu.fstec.ru/vul/2024-04906 · Security Note
• https://osv.dev/vulnerability/CVE-2024-6193 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-6193 · Security Note
• https://vuldb.com/?submit.359018 · Note
• https://vuldb.com/?ctiid.269165 · Note
• https://vuldb.com/?id.269165 · Note
• https://twitter.com/CVEnew/status/1803814926600802653 · Twitter Post
• https://t.me/cvenotify/83993 · Telegram Post