PT-2024-24135 · Unknown · Computer Laboratory Management System

Emirhan Mutlu

·

CVE-2024-31547

·

Published

2024-04-19

·

Updated

2024-07-03

CVSS v3.1

9.1

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Name of the Vulnerable Software and Affected Versions Computer Laboratory Management System version 1.0
Description The issue allows for SQL Injection via the id parameter of the "/admin/item/view item.php" API endpoint.
Recommendations For Computer Laboratory Management System version 1.0, avoid using the id parameter in the "/admin/item/view item.php" endpoint until the issue is resolved. Consider temporarily restricting access to this endpoint to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-31547

Affected Products

Computer Laboratory Management System