SQL Injection Vulnerability in Simple Car Rental System by Code-Projects
CVE-2024-11632
Key Information:
- Vendor
Code-projects
- Status
- Vendor
- CVE Published:
- 23 November 2024
Badges
What is CVE-2024-11632?
CVE-2024-11632 is a critical SQL injection vulnerability identified in Code-Projects' Simple Car Rental System version 1.0. The issue arises from improper handling of user input in the /book_car.php file, specifically the parameters, including fname, id_no, gender, email, phone, and location. Attackers can exploit this vulnerability remotely, potentially manipulating these parameters to execute unauthorized SQL commands against the underlying database. Initial reports indicated that only the 'fname' parameter was vulnerable; however, further investigation has revealed that multiple parameters are susceptible, escalating the risk of data breaches. Users of this system are urged to address this vulnerability immediately.
Affected Version(s)
Simple Car Rental System 1.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.