SQL Injection Vulnerability in Projectworlds Visitor Management System
CVE-2024-22983

8.1HIGH

Key Information:

Vendor

Projectworlds

Status
Visitor Management System
Vendor
CVE Published:
28 February 2024

What is CVE-2024-22983?

A SQL injection vulnerability exists in the Projectworlds Visitor Management System version 1.0. This flaw allows remote attackers to manipulate SQL queries by exploiting the 'name' parameter within the myform.php endpoint. Successful exploitation can lead to unauthorized privilege escalation, potentially enabling attackers to gain elevated access rights within the system.

References

http://visitor.com
http://projectworlds.com
https://github.com/keru6k/CVE-2024-22983/blob/main/CVE-20...

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.