SQL Injection Vulnerability in Sourcecodester Library Management System
CVE-2024-40402

6.3MEDIUM

Key Information:

Vendor

Sourcecodester
Status
Simple Library Management System
Vendor
CVE Published:
17 July 2024

What is CVE-2024-40402?

A SQL injection vulnerability exists in the 'ajax.php' file of the Sourcecodester Simple Library Management System version 1.0. This flaw results from inadequate validation of user inputs, specifically within the 'username' parameter. By exploiting this vulnerability, an attacker can execute arbitrary SQL commands, potentially accessing or manipulating sensitive data in the database. Proper sanitization and validation of user inputs are necessary to mitigate this risk and protect against unauthorized data access.

References

https://github.com/CveSecLook/cve/issues/49

CVSS V3.1

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.