CVE-2024-6970 | THREATINT

Assigner	VulDB
Reserved	2024-07-21
Published	2024-07-22
Updated	2024-08-01

Description

A vulnerability classified as critical has been found in itsourcecode Tailoring Management System 1.0. Affected is an unknown function of the file /staffcatadd.php. The manipulation of the argument title leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-272124.

Es wurde eine kritische Schwachstelle in itsourcecode Tailoring Management System 1.0 entdeckt. Betroffen hiervon ist ein unbekannter Ablauf der Datei /staffcatadd.php. Mittels Manipulieren des Arguments title mit unbekannten Daten kann eine sql injection-Schwachstelle ausgenutzt werden. Umgesetzt werden kann der Angriff über das Netzwerk. Der Exploit steht zur öffentlichen Verfügung.

MEDIUM: 5.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
MEDIUM: 6.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
MEDIUM: 6.3	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
6.5	CVSS:2.0/AV:N/AC:L/Au:S/C:P/I:P/A:P

Problem types

CWE-89 SQL Injection

Product status

1.0

affected

Timeline

2024-07-21:	Advisory disclosed
2024-07-21:	VulDB entry created
2024-07-21:	VulDB entry last update

Credits

Nosalt (VulDB User) 0x40067c4440

References

https://vuldb.com/?id.272124 (VDB-272124 | itsourcecode Tailoring Management System staffcatadd.php sql injection) vdb-entry technical-description

https://vuldb.com/?ctiid.272124 (VDB-272124 | CTI Indicators (IOB, IOC, TTP, IOA)) signature permissions-required

https://vuldb.com/?submit.378239 (Submit #378239 | itsourcecode Tailoring Management System Project In PHP With Source Code 1.0 SQL Injection) third-party-advisory

https://github.com/nosaltsea/cve/issues/1 exploit issue-tracking

cve.org CVE-2024-6970

nvd.nist.gov CVE-2024-6970

Download JSON