SQL Injection Vulnerability in 1000 Projects Bookstore Management System
CVE-2024-10998

9.8CRITICAL

Key Information:

Vendor: 1000 Projects
Status: Bookstore Management System
Vendor: CVE Published:; 8 November 2024

🔔 Create 1000 Projects Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2024-10998?

A severe SQL injection vulnerability has been identified in the 1000 Projects Bookstore Management System version 1.0, specifically affecting the file located at /admin/process_category_add.php. This security flaw enables attackers to manipulate input arguments, particularly the 'cat' parameter, to execute unauthorized SQL commands. The vulnerability can be exploited remotely, placing user data and the integrity of the database at significant risk. As the exploit has been publicly disclosed, it is crucial for users of this system to update their software and implement necessary security measures immediately to prevent potential data breaches.

Affected Version(s)

Bookstore Management System 1.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2024-10998 - Proof of Concept