SQL Injection Vulnerability in SourceCodester Simple Online Bidding System

CVE-2024-7800

What is CVE-2024-7800?

A significant SQL injection vulnerability exists in the SourceCodester Simple Online Bidding System version 1.0, specifically within the /simple-online-bidding-system/bidding/admin/ajax.php file when handling the delete_product action. Attackers can exploit this vulnerability by manipulating the 'id' argument to execute arbitrary SQL commands, potentially leading to unauthorized data access or modification. The exploit can be triggered remotely, increasing the risk to affected systems. Security researchers have publicly disclosed the details of this vulnerability, emphasizing the need for immediate patching to safeguard user data and system integrity.

References