SQL Injection Vulnerability in 1000 Projects Attendance Tracking Management System
CVE-2024-12927
Key Information:
- Vendor
1000 Projects
- Vendor
- CVE Published:
- 25 December 2024
Badges
What is CVE-2024-12927?
A security vulnerability has been identified in the Attendance Tracking Management System developed by 1000 Projects, specifically within the check_faculty_login.php file. This issue arises from inadequate input validation on the faculty_emailid parameter, which allows attackers to execute SQL injection attacks remotely. This manipulation could enable unauthorized access to sensitive data, making it crucial for users of this system to apply necessary mitigations and updates to secure their applications. The exploit has already been publicly disclosed, heightening the urgency to address this security flaw.
Affected Version(s)
Attendance Tracking Management System 1.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.