CVE-2024-11592

A vulnerability has been found in 1000 Projects Beauty Parlour Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/about-us.php. The manipulation of the argument pagetitle leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

CVSS v3.0 9.8 CRITICAL

9.8^/10

CVSS v3.0 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://1000projects.org/	Product
https://github.com/Hacker0xone/CVE/issues/15	Exploit Third Party Advisory
https://vuldb.com/?ctiid.285664	Permissions Required
https://vuldb.com/?id.285664	Third Party Advisory
https://vuldb.com/?submit.445719	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:1000projects:beauty_parlour_management_system:1.0:*:*:*:*:*:*:*

History

10 Dec 2024, 16:52

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-11-21 15:15

Updated : 2024-12-10 16:52

NVD link : CVE-2024-11592

Mitre link : CVE-2024-11592

JSON object : View

Products Affected

1000projects

beauty_parlour_management_system

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://1000projects.org/", "name": "https://1000projects.org/", "tags": ["Product"], "refsource": ""}, {"url": "https://github.com/Hacker0xone/CVE/issues/15", "name": "https://github.com/Hacker0xone/CVE/issues/15", "tags": ["Exploit", "Third Party Advisory"], "refsource": ""}, {"url": "https://vuldb.com/?ctiid.285664", "name": "VDB-285664 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["Permissions Required"], "refsource": ""}, {"url": "https://vuldb.com/?id.285664", "name": "VDB-285664 | 1000 Projects Beauty Parlour Management System about-us.php sql injection", "tags": ["Third Party Advisory"], "refsource": ""}, {"url": "https://vuldb.com/?submit.445719", "name": "Submit #445719 | 1000 Projects Beauty Parlour Management System PHP SQLite Project V1.0 SQL Injection", "tags": ["Third Party Advisory"], "refsource": ""}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "A vulnerability has been found in 1000 Projects Beauty Parlour Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/about-us.php. The manipulation of the argument pagetitle leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-89"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2024-11592", "ASSIGNER": "cna@vuldb.com"}}, "impact": {"baseMetricV3": {"cvssV3": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}}, "publishedDate": "2024-11-21T15:15Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:1000projects:beauty_parlour_management_system:1.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2024-12-10T16:52Z"}