SQL Injection Vulnerability in Project Worlds Life Insurance Management System
CVE-2024-10735

9.8CRITICAL

Key Information:

Vendor: Project Worlds
Status: Life Insurance Management System
Vendor: CVE Published:; 3 November 2024

🔔 Create Project Worlds Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2024-10735?

A critical security vulnerability has been identified in the Project Worlds Life Insurance Management System version 1.0, specifically targeting the /editNominee.php file. This flaw allows attackers to execute SQL injection via the nominee_id parameter, enabling them to manipulate the system's database directly. The exploitation of this vulnerability can occur remotely, exposing sensitive user data and potentially compromising the entire application. Given that the exploit has been publicly disclosed, it is crucial for users of this software to apply necessary patches and take preventive measures to secure their systems against potential attacks. For detailed information, visit the references provided.

Affected Version(s)

Life Insurance Management System 1.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2024-10735 - Proof of Concept