Paper/Archive/CVE-2024-9008

CVE-2024-9008

SourceCodester Best Online News Portal — SourceCodester Best Online News Portal Comment Section news-details.php sql injection

EPSS 0.6%public exploit CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 50.9.509 × 2010.2 Exploit: SSVC poc+1010.0 SSVC exploitation: poc+100.0

Description · from the CVE record

A vulnerability classified as critical was found in SourceCodester Best Online News Portal 1.0. This vulnerability affects unknown code of the file /news-details.php of the component Comment Section. The manipulation of the argument name leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Affected

ProductAffectedFixed inSource

Best Online News Portal1.0–CNA

best_online_news_portal1.0–CISA-ADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

VulDB (CNA)6.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

VulDB (CNA)6.3CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

VulDB (CNA)5.3CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

writeupvuldb.com/?id.278164 refvuldb.com/?ctiid.278164 writeupvuldb.com/?submit.409956 exploitgithub.com/gurudattch/CVEs/blob/main/Sourcecodester-News-Portal-Comment-Blind-SQLi.md refsourcecodester.com