Paper/Archive/CVE-2024-28557

CVE-2024-28557

sourcecodester php_task_management_system — SQL Injection vulnerability in Sourcecodester php task management system v1.0, allows remote attackers to execute arbitrary code, escalat…

EPSS 1%public exploit CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (ADP)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 69.0.690 × 2013.8 Exploit: SSVC poc+1010.0 SSVC exploitation: poc+100.0

Description · from the CVE record

SQL Injection vulnerability in Sourcecodester php task management system v1.0, allows remote attackers to execute arbitrary code, escalate privileges, and obtain sensitive information via crafted payload to update-admin.php.

Affected

ProductAffectedFixed inSource

n/an/a–CNA

php_task_management_system1.0–CISA-ADP

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refgithub.com/xuanluansec/vul/blob/main/vul/2/README-SQL-2.md refgithub.com/xuanluansec/vul/issues/2