SQL Injection Vulnerability in 1000 Projects Attendance Tracking Management System
CVE-2024-12497

9.8CRITICAL

Key Information:

Vendor: 1000 Projects
Status: Attendance Tracking Management System
Vendor: CVE Published:; 12 December 2024

🔔 Create 1000 Projects Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2024-12497?

CVE-2024-12497 represents a critical SQL injection vulnerability found in the 1000 Projects Attendance Tracking Management System version 1.0. An attacker can manipulate the 'admin_user_name' parameter in the /admin/check_admin_login.php file, allowing for unauthorized database access and potential data compromise. This vulnerability can be exploited remotely, heightening the risk for users and organizations relying on this application for attendance tracking. Immediate action is advised to mitigate potential exploitation.

Affected Version(s)

Attendance Tracking Management System 1.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2024-12497 - Proof of Concept