Paper/Archive/CVE-2024-0485

CVE-2024-0485

code-projects Fighting Cock Information System — code-projects Fighting Cock Information System add_con.php sql injection

EPSS 0.5%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 44.0.440 × 208.8 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

A vulnerability, which was classified as critical, was found in code-projects Fighting Cock Information System 1.0. Affected is an unknown function of the file admin/pages/tables/add_con.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-250590 is the identifier assigned to this vulnerability.

Affected

ProductAffectedFixed inSource

Fighting Cock Information System1.0–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

VulDB (CNA)6.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

VulDB (CNA)6.3CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

writeupvuldb.com/?id.250590 refvuldb.com/?ctiid.250590 exploitgithub.com/yingqian1984/FirePunch/blob/main/Fighting%20Cock%20Information%20System/FIGHTING_COCK_INFORMATION_SYSTEM_SQL7.pdf refvicarius.io/vsociety/posts/cve-2024-0485-yet-another-sqli-in-fighting-cock-information-system-10-exploited-for-fun-and-profit