SQL Injection Vulnerability in Project Worlds Student Project Allocation System
CVE-2024-10424

9.8CRITICAL

Key Information:

Vendor: Project Worlds
Status: Student Project Allocation System
Vendor: CVE Published:; 27 October 2024

🔔 Create Project Worlds Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2024-10424?

A severe SQL injection vulnerability has been identified in the Project Worlds Student Project Allocation System version 1.0. The vulnerability stems from improper handling of the input parameter 'no' in the file /student/project_selection/remove_project.php, which can be targeted to execute arbitrary SQL commands against the underlying database. This flaw allows attackers to manipulate queries and may lead to unauthorized access and extraction of sensitive information. The exploitation of this vulnerability can be executed remotely, raising the risk level significantly as it affects the application's core functionality found in the Project Selection Page. Security experts advise immediate assessment and patching to mitigate potential threats.

Affected Version(s)

Student Project Allocation System 1.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2024-10424 - Proof of Concept