A vulnerability classified as critical has been found in SourceCodester Computer Laboratory Management System 1.0. Affected is the function update_settings_info of the file /classes/SystemSettings.php?f=update_settings. The manipulation of the argument name leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
References
| Link | Resource |
|---|---|
| https://vuldb.com/?id.276228 | Third Party Advisory VDB Entry |
| https://vuldb.com/?ctiid.276228 | Permissions Required |
| https://vuldb.com/?submit.400343 | Third Party Advisory VDB Entry |
| https://github.com/gaorenyusi/gaorenyusi/blob/main/lms1.md | Exploit |
| https://www.sourcecodester.com/ | Product |
Configurations
History
04 Sep 2024, 16:37
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:oretnom23:computer_laboratory_management_system:1.0:*:*:*:*:*:*:* | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
| First Time |
Oretnom23 computer Laboratory Management System
Oretnom23 |
|
| References | () https://github.com/gaorenyusi/gaorenyusi/blob/main/lms1.md - Exploit | |
| References | () https://vuldb.com/?id.276228 - Third Party Advisory, VDB Entry | |
| References | () https://vuldb.com/?submit.400343 - Third Party Advisory, VDB Entry | |
| References | () https://vuldb.com/?ctiid.276228 - Permissions Required | |
| References | () https://www.sourcecodester.com/ - Product |
30 Aug 2024, 21:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-08-30 21:15
Updated : 2024-09-04 16:37
NVD link : CVE-2024-8346
Mitre link : CVE-2024-8346
JSON object : View
Products Affected
oretnom23
- computer_laboratory_management_system
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')