CVE-2024-8346

A vulnerability classified as critical has been found in SourceCodester Computer Laboratory Management System 1.0. Affected is the function update_settings_info of the file /classes/SystemSettings.php?f=update_settings. The manipulation of the argument name leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
References
Configurations

Configuration 1 (hide)

cpe:2.3:a:oretnom23:computer_laboratory_management_system:1.0:*:*:*:*:*:*:*

History

04 Sep 2024, 16:37

Type Values Removed Values Added
CVSS v2 : 6.5
v3 : 6.3
v2 : 6.5
v3 : 9.8
First Time Oretnom23 computer Laboratory Management System
Oretnom23
References () https://github.com/gaorenyusi/gaorenyusi/blob/main/lms1.md - () https://github.com/gaorenyusi/gaorenyusi/blob/main/lms1.md - Exploit
References () https://vuldb.com/?ctiid.276228 - () https://vuldb.com/?ctiid.276228 - Permissions Required
References () https://vuldb.com/?id.276228 - () https://vuldb.com/?id.276228 - Third Party Advisory, VDB Entry
References () https://vuldb.com/?submit.400343 - () https://vuldb.com/?submit.400343 - Third Party Advisory, VDB Entry
References () https://www.sourcecodester.com/ - () https://www.sourcecodester.com/ - Product
CPE cpe:2.3:a:oretnom23:computer_laboratory_management_system:1.0:*:*:*:*:*:*:*

03 Sep 2024, 12:59

Type Values Removed Values Added
Summary
  • (es) Se ha encontrado una vulnerabilidad clasificada como crítica en SourceCodester Computer Laboratory Management System 1.0. La función update_settings_info del archivo /classes/SystemSettings.php?f=update_settings se ve afectada. La manipulación del nombre del argumento provoca una inyección SQL. Es posible lanzar el ataque de forma remota. El exploit ha sido divulgado al público y puede ser utilizado.

30 Aug 2024, 21:15

Type Values Removed Values Added
New CVE

Information

Published : 2024-08-30 21:15

Updated : 2024-09-04 16:37


NVD link : CVE-2024-8346

Mitre link : CVE-2024-8346

CVE.ORG link : CVE-2024-8346


JSON object : View

Products Affected

oretnom23

  • computer_laboratory_management_system
CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')