What is the CVSS score of CVE-2024-26492?

CVE-2024-26492 has a CVSS 3.1 base score of 6.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.6%.

Is there a public PoC exploit available for CVE-2024-26492?

Yes, a public proof-of-concept exploit is available for CVE-2024-26492. Prioritise patching immediately. EPSS: 0.6%.

Online Diagnostic Lab Management System CVE-2024-26492

MEDIUM

2024-03-07 cve@mitre.org

Information Disclosure Online Diagnostic Lab Management System

6.3

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

6.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

CVE Published

Mar 07, 2024 - 21:15 cve.org

MEDIUM 6.3

DescriptionCVE.org

AnalysisAI

An issue in Online Diagnostic Lab Management System 1.0 allows a remote attacker to gain control of a 'Staff' user account via a crafted POST request using the id, email, password, and cpass. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

An issue in Online Diagnostic Lab Management System 1.0 allows a remote attacker to gain control of a 'Staff' user account via a crafted POST request using the id, email, password, and cpass parameters. Affected products include: Oretnom23 Online Diagnostic Lab Management System.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Online Diagnostic Lab Management System

View all

CVE-2022-43135 CRITICAL Act Now POC

9.8 Nov 16

Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the username pa

CVE-2022-42064 CRITICAL Act Now POC

9.8 Oct 14

Online Diagnostic Lab Management System version 1.0 remote exploit that bypasses login with SQL injection and then uploa

CVE-2022-37152 CRITICAL Act Now POC

9.8 Aug 26

An issue was discovered in Online Diagnostic Lab Management System 1.0, There is a SQL injection vulnerability via "dob"

CVE-2022-43226 HIGH This Week POC

8.8 Nov 02