SQL Injection Vulnerability in SourceCodester Employee Management System
CVE-2024-1878

8.8HIGH

Key Information:

Vendor
Sourcecodester
Status
Employee Management System
Vendor
CVE Published:
26 February 2024

Badges

👾 Exploit Exists🟡 Public PoC

Summary

A vulnerability has been discovered within the SourceCodester Employee Management System 1.0 that exposes a critical security risk through an SQL injection flaw found in the /myprofile.php file. This attack exploits the manipulation of the 'id' parameter by injecting code, such as '1%20or%201=1', which allows an attacker to execute arbitrary SQL commands within the database. As a result, unauthorized users may gain access to sensitive information, modify data, or potentially take full control of the underlying database. Remedial actions should be taken promptly to mitigate the risk associated with this vulnerability. For more information, visit VDB-254726.

Affected Version(s)

Employee Management System 1.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2024-1878 - Proof of Concept

References

https://vuldb.com/?id.254726
vdb-entrytechnical-description
https://vuldb.com/?ctiid.254726
signaturepermissions-required
https://github.com/skid-nochizplz/skid-nochizplz/blob/mai...
exploit

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Joshua Lictan
nochizplz (VulDB User)
nochizplz (VulDB User)
.