by Kastro
Paper/Archive/CVE-2024-11059

CVE-2024-11059

Project Worlds Free Download Online Shopping System — Project Worlds Free Download Online Shopping System success.php sql injection

EPSS 0.5%public exploitCVSS 9.8
critical.is priorityof 100
48
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 43.4.434 × 208.7Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

A vulnerability was found in Project Worlds Free Download Online Shopping System up to 192.168.1.88. It has been rated as critical. This issue affects some unknown processing of the file /online-shopping-webvsite-in-php-master/success.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

Affected

ProductAffectedFixed inSource
Free Download Online Shopping System0.3–CNA
Free Download Online Shopping System0.5–CNA
Free Download Online Shopping System0.8–CNA
Free Download Online Shopping System0.9–CNA
Free Download Online Shopping System1.0–CNA
Free Download Online Shopping System1.1–CNA
Free Download Online Shopping System5.0–CNA
Free Download Online Shopping System10.0–CNA
Free Download Online Shopping System46.0–CNA
Free Download Online Shopping System192.168.1.88–CNA
free_download_online_shopping_system0.3–CISA-ADP
free_download_online_shopping_system0.5–CISA-ADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulDB (CNA)6.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
VulDB (CNA)6.3CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
VulDB (CNA)5.3CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: partial

References

writeupvuldb.com/?id.283805refvuldb.com/?ctiid.283805writeupvuldb.com/?submit.440337exploitgithub.com/Sy0ung-cmd/Cve-report/blob/main/SQLi-1.md