SQL Injection Vulnerability in SourceCodester Advocate Office Management System
CVE-2024-9295

9.8CRITICAL

Key Information:

Vendor

Mayurik

Status
Advocate Office Management System
Vendor
CVE Published:
28 September 2024

What is CVE-2024-9295?

A significant vulnerability has been identified in the Advocate Office Management System by SourceCodester, specifically within the login.php file. This security flaw allows unauthorized users to exploit the application by manipulating the username parameter, leading to SQL injection vulnerabilities. Attackers can execute malicious SQL statements to access sensitive data or compromise the database remotely. Given its public disclosure, it poses a notable risk to users of this software version. Implementing proper validation and sanitation measures is crucial to safeguarding against such vulnerabilities.

References

https://vuldb.com/?id.278789
https://vuldb.com/?ctiid.278789
https://vuldb.com/?submit.412450

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.