SQL Injection Vulnerability in 1000 Projects Beauty Parlour Management System
CVE-2024-11647

9.8CRITICAL

Key Information:

Vendor: 1000 Projects
Status: Beauty Parlour Management System
Vendor: CVE Published:; 25 November 2024

🔔 Create 1000 Projects Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2024-11647?

CVE-2024-11647 is a critical SQL injection vulnerability identified in version 1.0 of the 1000 Projects Beauty Parlour Management System. The vulnerability resides in the /admin/view-appointment.php file, where improper handling of the 'viewid' parameter allows attackers to manipulate SQL queries. This enables remote attackers to execute malicious SQL commands potentially leading to unauthorized access, data leakage, or data manipulation. As this exploit has been publicly disclosed, immediate remedial actions such as updating to secure versions or applying necessary patches are strongly recommended.

Affected Version(s)

Beauty Parlour Management System 1.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2024-11647 - Proof of Concept