SQL Injection Vulnerability in Project Worlds Student Project Allocation System
CVE-2024-10423

9.8CRITICAL

Key Information:

Vendor: Project Worlds
Status: Student Project Allocation System
Vendor: CVE Published:; 27 October 2024

🔔 Create Project Worlds Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2024-10423?

A significant vulnerability exists within the Project Worlds Student Project Allocation System, specifically in the project_selection.php file of the project selection page component. This vulnerability arises from an unsafe handling of the 'project_id' argument, leading to a potential SQL injection attack. Attackers can exploit this remotely, allowing unauthorized access to sensitive data. The exploit has been publicly disclosed, heightening the urgency for users of version 1.0 of the system to implement immediate security measures and updates to mitigate potential risks associated with this vulnerability.

Affected Version(s)

Student Project Allocation System 1.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2024-10423 - Proof of Concept