SQL Injection Vulnerability in Code-Projects Travel Management System

CVE-2024-12949

Summary

A vulnerability has been identified in the Travel Management System version 1.0 developed by Code-Projects. This security flaw resides in the package.php file, where improper handling of the 'subcatid' argument exposes the application to SQL injection attacks. An attacker can manipulate this argument to execute arbitrary SQL queries, potentially compromising the database and sensitive information. The exploitation of this vulnerability can be conducted remotely, raising significant security concerns for users of the Travel Management System. It is crucial for organizations utilizing this software to assess their current security measures and apply necessary updates to mitigate risk.

References