CVE-2024-0466
MEDIUMCVSS Vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Lifecycle Timeline
2Description
A vulnerability, which was classified as critical, has been found in code-projects Employee Profile Management System 1.0. This issue affects some unknown processing of the file file_table.php. The manipulation of the argument per_id leads to sql injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250571.
Analysis
A vulnerability, which was classified as critical, has been found in code-projects Employee Profile Management System 1.0.php. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
Technical Context
This vulnerability is classified as SQL Injection (CWE-89), which allows attackers to execute arbitrary SQL commands against the database. A vulnerability, which was classified as critical, has been found in code-projects Employee Profile Management System 1.0.php. The manipulation of the argument per_id leads to sql injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250571. Affected products include: Code-Projects Employee Profile Management System.
Affected Products
Code-Projects Employee Profile Management System.
Remediation
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Use parameterized queries/prepared statements. Never concatenate user input into SQL. Apply least-privilege database permissions.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today