SQL Injection Flaw in SourceCodester Employee and Visitor Gate Pass Logging System
CVE-2024-6736

8.8HIGH

Key Information:

Vendor

SourceCodester
Status
Employee And Visitor Gate Pass Logging System
Vendor
CVE Published:
15 July 2024

What is CVE-2024-6736?

A critical SQL injection vulnerability exists in the SourceCodester Employee and Visitor Gate Pass Logging System version 1.0, specifically affecting the file view_employee.php. The vulnerability arises due to improper handling of user-supplied input in the 'id' argument, enabling remote attackers to execute arbitrary SQL commands through crafted requests. This flaw may allow adversaries to gain unauthorized access to sensitive data and manipulate the database. The vulnerability has been disclosed publicly, highlighting the urgent need for affected users to implement protective measures and updates.

References

https://vuldb.com/?id.271457
https://vuldb.com/?ctiid.271457
https://vuldb.com/?submit.374485

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.