SQL Injection Vulnerability in 1000 Projects Beauty Parlour Management System
CVE-2024-11646

9.8CRITICAL

Key Information:

Vendor: 1000 Projects
Status: Beauty Parlour Management System
Vendor: CVE Published:; 25 November 2024

🔔 Create 1000 Projects Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2024-11646?

A critical SQL injection vulnerability has been identified in the 1000 Projects Beauty Parlour Management System version 1.0. The vulnerability is found in the 'edit-services.php' file, specifically in the handling of the 'sername' parameter. This flaw allows authenticated attackers to execute arbitrary SQL commands via a specially crafted request, potentially compromising the database and exposing sensitive information. The vulnerability can be exploited remotely, making it a pressing concern for users of this software. As the exploit has been disclosed publicly, immediate action is recommended for users to mitigate risks associated with this vulnerability.

Affected Version(s)

Beauty Parlour Management System 1.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2024-11646 - Proof of Concept