Paper/Archive/CVE-2024-10758

CVE-2024-10758

code-projects Content Management System — code-projects/anirbandutta9 Content Management System/News-Buzz index.php sql injection

EPSS 1%public exploit CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 72.9.729 × 2014.6 Exploit: SSVC poc+1010.0 SSVC exploitation: poc+100.0

Description · from the CVE record

A vulnerability, which was classified as critical, was found in code-projects/anirbandutta9 Content Management System and News-Buzz 1.0. This affects an unknown part of the file /index.php. The manipulation of the argument user_name leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product is distributed under two entirely different names.

Affected

ProductAffectedFixed inSource

Content Management System1.0–CNA

News-Buzz1.0–CNA

Content Management System1.0–CNA

News-Buzz1.0–CNA

content_management_system1.0–CISA-ADP

news-buzz1.0–CISA-ADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

VulDB (CNA)7.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

VulDB (CNA)7.3CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

VulDB (CNA)6.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: partial

References

writeupvuldb.com/?id.282927 refvuldb.com/?ctiid.282927 writeupvuldb.com/?submit.436395 exploitgithub.com/EmilGallajov/zero-day/blob/main/content_management_system_sqli.md