PT-2024-24134 · Unknown · Computer Laboratory Management System

Emirhan Mutlu

·

CVE-2024-31546

·

Published

2024-04-19

·

Updated

2024-07-03

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Computer Laboratory Management System version 1.0
Description The issue concerns SQL Injection via the id parameter of the "/admin/damage/view damage.php" API endpoint.
Recommendations For Computer Laboratory Management System version 1.0, consider restricting access to the "/admin/damage/view damage.php" endpoint until a patch is available, and avoid using the id parameter in this endpoint to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-31546

Affected Products

Computer Laboratory Management System