All the vulnerabilites related to Codezips - Free Exam Hall Seating Management System
cve-2024-10507
Vulnerability from cvelistv5
Published
2024-10-30 02:31
Modified
2024-10-30 14:59
Severity ?
6.9 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
7.3 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
7.3 (High) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
7.3 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
7.3 (High) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
EPSS score ?
Summary
A vulnerability classified as critical was found in Codezips Free Exam Hall Seating Management System 1.0. This vulnerability affects unknown code of the file /login.php. The manipulation of the argument email leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
References
▼ | URL | Tags |
---|---|---|
https://vuldb.com/?id.282448 | vdb-entry, technical-description | |
https://vuldb.com/?ctiid.282448 | signature, permissions-required | |
https://vuldb.com/?submit.432719 | third-party-advisory | |
https://github.com/ppp-src/CVE/issues/26 | exploit, issue-tracking |
Impacted products
Vendor | Product | Version | |
---|---|---|---|
▼ | Codezips | Free Exam Hall Seating Management System |
Version: 1.0 |
|
{ "containers": { "adp": [ { "affected": [ { "cpes": [ "cpe:2.3:a:codezips:free_exam_hall_seating_management_system:1.0:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "free_exam_hall_seating_management_system", "vendor": "codezips", "versions": [ { "status": "affected", "version": "1.0" } ] } ], "metrics": [ { "other": { "content": { "id": "CVE-2024-10507", "options": [ { "Exploitation": "poc" }, { "Automatable": "yes" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-10-30T13:57:34.795094Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-10-30T14:59:09.833Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "Free Exam Hall Seating Management System", "vendor": "Codezips", "versions": [ { "status": "affected", "version": "1.0" } ] } ], "credits": [ { "lang": "en", "type": "reporter", "value": "XU RONGDA (VulDB User)" } ], "descriptions": [ { "lang": "en", "value": "A vulnerability classified as critical was found in Codezips Free Exam Hall Seating Management System 1.0. This vulnerability affects unknown code of the file /login.php. The manipulation of the argument email leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used." }, { "lang": "de", "value": "In Codezips Free Exam Hall Seating Management System 1.0 wurde eine Schwachstelle entdeckt. Sie wurde als kritisch eingestuft. Dabei geht es um eine nicht genauer bekannte Funktion der Datei /login.php. Dank Manipulation des Arguments email mit unbekannten Daten kann eine sql injection-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs kann dabei \u00fcber das Netzwerk erfolgen. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung." } ], "metrics": [ { "cvssV4_0": { "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N", "version": "4.0" } }, { "cvssV3_1": { "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" } }, { "cvssV3_0": { "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.0" } }, { "cvssV2_0": { "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-89", "description": "SQL Injection", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-10-30T02:31:04.367Z", "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB" }, "references": [ { "name": "VDB-282448 | Codezips Free Exam Hall Seating Management System login.php sql injection", "tags": [ "vdb-entry", "technical-description" ], "url": "https://vuldb.com/?id.282448" }, { "name": "VDB-282448 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": [ "signature", "permissions-required" ], "url": "https://vuldb.com/?ctiid.282448" }, { "name": "Submit #432719 | Codezips Free Exam Hall Seating Management System In PHP with Source Code V1.0 SQL Injection", "tags": [ "third-party-advisory" ], "url": "https://vuldb.com/?submit.432719" }, { "tags": [ "exploit", "issue-tracking" ], "url": "https://github.com/ppp-src/CVE/issues/26" } ], "timeline": [ { "lang": "en", "time": "2024-10-29T00:00:00.000Z", "value": "Advisory disclosed" }, { "lang": "en", "time": "2024-10-29T01:00:00.000Z", "value": "VulDB entry created" }, { "lang": "en", "time": "2024-10-29T18:58:22.000Z", "value": "VulDB entry last update" } ], "title": "Codezips Free Exam Hall Seating Management System login.php sql injection" } }, "cveMetadata": { "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "assignerShortName": "VulDB", "cveId": "CVE-2024-10507", "datePublished": "2024-10-30T02:31:04.367Z", "dateReserved": "2024-10-29T17:53:07.335Z", "dateUpdated": "2024-10-30T14:59:09.833Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-10737
Vulnerability from cvelistv5
Published
2024-11-03 15:00
Modified
2024-11-05 14:44
Severity ?
6.9 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
7.3 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
7.3 (High) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
7.3 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
7.3 (High) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
EPSS score ?
Summary
A vulnerability classified as critical has been found in Codezips Free Exam Hall Seating Management System 1.0. Affected is an unknown function of the file /teacher.php. The manipulation of the argument email leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
References
▼ | URL | Tags |
---|---|---|
https://vuldb.com/?id.282906 | vdb-entry, technical-description | |
https://vuldb.com/?ctiid.282906 | signature, permissions-required | |
https://vuldb.com/?submit.435487 | third-party-advisory | |
https://github.com/Scholar-XD/CVE/issues/1 | exploit, issue-tracking |
Impacted products
Vendor | Product | Version | |
---|---|---|---|
▼ | Codezips | Free Exam Hall Seating Management System |
Version: 1.0 |
|
{ "containers": { "adp": [ { "affected": [ { "cpes": [ "cpe:2.3:a:codezips:free_exam_hall_seating_management_system:1.0:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "free_exam_hall_seating_management_system", "vendor": "codezips", "versions": [ { "status": "affected", "version": "1.0" } ] } ], "metrics": [ { "other": { "content": { "id": "CVE-2024-10737", "options": [ { "Exploitation": "poc" }, { "Automatable": "yes" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-11-05T14:43:47.079124Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-11-05T14:44:39.779Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "Free Exam Hall Seating Management System", "vendor": "Codezips", "versions": [ { "status": "affected", "version": "1.0" } ] } ], "credits": [ { "lang": "en", "type": "reporter", "value": "2436038564XD (VulDB User)" } ], "descriptions": [ { "lang": "en", "value": "A vulnerability classified as critical has been found in Codezips Free Exam Hall Seating Management System 1.0. Affected is an unknown function of the file /teacher.php. The manipulation of the argument email leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used." }, { "lang": "de", "value": "Es wurde eine kritische Schwachstelle in Codezips Free Exam Hall Seating Management System 1.0 entdeckt. Hiervon betroffen ist ein unbekannter Codeblock der Datei /teacher.php. Durch Manipulieren des Arguments email mit unbekannten Daten kann eine sql injection-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk angegangen werden. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung." } ], "metrics": [ { "cvssV4_0": { "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N", "version": "4.0" } }, { "cvssV3_1": { "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" } }, { "cvssV3_0": { "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.0" } }, { "cvssV2_0": { "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-89", "description": "SQL Injection", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-11-03T15:00:07.754Z", "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB" }, "references": [ { "name": "VDB-282906 | Codezips Free Exam Hall Seating Management System teacher.php sql injection", "tags": [ "vdb-entry", "technical-description" ], "url": "https://vuldb.com/?id.282906" }, { "name": "VDB-282906 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": [ "signature", "permissions-required" ], "url": "https://vuldb.com/?ctiid.282906" }, { "name": "Submit #435487 | Codezips Free Exam Hall Seating Management System In PHP with Source Code V1.0 SQL Injection", "tags": [ "third-party-advisory" ], "url": "https://vuldb.com/?submit.435487" }, { "tags": [ "exploit", "issue-tracking" ], "url": "https://github.com/Scholar-XD/CVE/issues/1" } ], "timeline": [ { "lang": "en", "time": "2024-11-02T00:00:00.000Z", "value": "Advisory disclosed" }, { "lang": "en", "time": "2024-11-02T01:00:00.000Z", "value": "VulDB entry created" }, { "lang": "en", "time": "2024-11-02T19:18:25.000Z", "value": "VulDB entry last update" } ], "title": "Codezips Free Exam Hall Seating Management System teacher.php sql injection" } }, "cveMetadata": { "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "assignerShortName": "VulDB", "cveId": "CVE-2024-10737", "datePublished": "2024-11-03T15:00:07.754Z", "dateReserved": "2024-11-02T18:13:19.225Z", "dateUpdated": "2024-11-05T14:44:39.779Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-11661
Vulnerability from cvelistv5
Published
2024-11-25 07:31
Modified
2024-11-25 15:56
Severity ?
5.3 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
4.3 (Medium) - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
4.3 (Medium) - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
EPSS score ?
Summary
A vulnerability was found in Codezips Free Exam Hall Seating Management System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file profile.php of the component Profile Image Handler. The manipulation of the argument image leads to unrestricted upload. The attack can be initiated remotely. The researcher submit confuses the vulnerability class of this issue.
References
▼ | URL | Tags |
---|---|---|
https://vuldb.com/?id.285982 | vdb-entry, technical-description | |
https://vuldb.com/?ctiid.285982 | signature, permissions-required | |
https://vuldb.com/?submit.447115 | third-party-advisory | |
https://github.com/anqi12301/CVE/issues/1 | issue-tracking |
Impacted products
Vendor | Product | Version | |
---|---|---|---|
▼ | Codezips | Free Exam Hall Seating Management System |
Version: 1.0 |
|
{ "containers": { "adp": [ { "affected": [ { "cpes": [ "cpe:2.3:a:codezips:free_exam_hall_seating_management_system:1.0:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "free_exam_hall_seating_management_system", "vendor": "codezips", "versions": [ { "status": "affected", "version": "1.0" } ] } ], "metrics": [ { "other": { "content": { "id": "CVE-2024-11661", "options": [ { "Exploitation": "poc" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-11-25T15:54:08.952523Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-11-25T15:56:19.755Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "modules": [ "Profile Image Handler" ], "product": "Free Exam Hall Seating Management System", "vendor": "Codezips", "versions": [ { "status": "affected", "version": "1.0" } ] } ], "credits": [ { "lang": "en", "type": "reporter", "value": "0e1G7 (VulDB User)" } ], "descriptions": [ { "lang": "en", "value": "A vulnerability was found in Codezips Free Exam Hall Seating Management System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file profile.php of the component Profile Image Handler. The manipulation of the argument image leads to unrestricted upload. The attack can be initiated remotely. The researcher submit confuses the vulnerability class of this issue." }, { "lang": "de", "value": "In Codezips Free Exam Hall Seating Management System 1.0 wurde eine Schwachstelle ausgemacht. Sie wurde als problematisch eingestuft. Betroffen ist eine unbekannte Verarbeitung der Datei profile.php der Komponente Profile Image Handler. Durch Manipulation des Arguments image mit unbekannten Daten kann eine unrestricted upload-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk passieren." } ], "metrics": [ { "cvssV4_0": { "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "version": "4.0" } }, { "cvssV3_1": { "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" } }, { "cvssV3_0": { "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "version": "3.0" } }, { "cvssV2_0": { "baseScore": 4, "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P", "version": "2.0" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-434", "description": "Unrestricted Upload", "lang": "en", "type": "CWE" } ] }, { "descriptions": [ { "cweId": "CWE-284", "description": "Improper Access Controls", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-11-25T07:31:04.446Z", "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB" }, "references": [ { "name": "VDB-285982 | Codezips Free Exam Hall Seating Management System Profile Image profile.php unrestricted upload", "tags": [ "vdb-entry", "technical-description" ], "url": "https://vuldb.com/?id.285982" }, { "name": "VDB-285982 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": [ "signature", "permissions-required" ], "url": "https://vuldb.com/?ctiid.285982" }, { "name": "Submit #447115 | Codezips Free Exam Hall Seating Management System In PHP with Source Code V1.0 SQL Injection", "tags": [ "third-party-advisory" ], "url": "https://vuldb.com/?submit.447115" }, { "tags": [ "issue-tracking" ], "url": "https://github.com/anqi12301/CVE/issues/1" } ], "timeline": [ { "lang": "en", "time": "2024-11-24T00:00:00.000Z", "value": "Advisory disclosed" }, { "lang": "en", "time": "2024-11-24T01:00:00.000Z", "value": "VulDB entry created" }, { "lang": "en", "time": "2024-11-24T16:24:49.000Z", "value": "VulDB entry last update" } ], "title": "Codezips Free Exam Hall Seating Management System Profile Image profile.php unrestricted upload" } }, "cveMetadata": { "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "assignerShortName": "VulDB", "cveId": "CVE-2024-11661", "datePublished": "2024-11-25T07:31:04.446Z", "dateReserved": "2024-11-24T15:19:40.693Z", "dateUpdated": "2024-11-25T15:56:19.755Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-10736
Vulnerability from cvelistv5
Published
2024-11-03 14:31
Modified
2024-11-04 20:20
Severity ?
6.9 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
7.3 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
7.3 (High) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
7.3 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
7.3 (High) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
EPSS score ?
Summary
A vulnerability was found in Codezips Free Exam Hall Seating Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /student.php. The manipulation of the argument email leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
References
▼ | URL | Tags |
---|---|---|
https://vuldb.com/?id.282905 | vdb-entry, technical-description | |
https://vuldb.com/?ctiid.282905 | signature, permissions-required | |
https://vuldb.com/?submit.435425 | third-party-advisory | |
https://github.com/EddieAy/cve/issues/3 | exploit, issue-tracking |
Impacted products
Vendor | Product | Version | |
---|---|---|---|
▼ | Codezips | Free Exam Hall Seating Management System |
Version: 1.0 |
|
{ "containers": { "adp": [ { "affected": [ { "cpes": [ "cpe:2.3:a:codezips:free_exam_hall_seating_management_system:1.0:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "free_exam_hall_seating_management_system", "vendor": "codezips", "versions": [ { "status": "affected", "version": "1.0" } ] } ], "metrics": [ { "other": { "content": { "id": "CVE-2024-10736", "options": [ { "Exploitation": "poc" }, { "Automatable": "yes" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-11-04T20:13:17.385032Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-11-04T20:20:17.861Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "Free Exam Hall Seating Management System", "vendor": "Codezips", "versions": [ { "status": "affected", "version": "1.0" } ] } ], "credits": [ { "lang": "en", "type": "reporter", "value": "EddieAy (VulDB User)" } ], "descriptions": [ { "lang": "en", "value": "A vulnerability was found in Codezips Free Exam Hall Seating Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /student.php. The manipulation of the argument email leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used." }, { "lang": "de", "value": "Eine Schwachstelle wurde in Codezips Free Exam Hall Seating Management System 1.0 ausgemacht. Sie wurde als kritisch eingestuft. Davon betroffen ist unbekannter Code der Datei /student.php. Durch das Manipulieren des Arguments email mit unbekannten Daten kann eine sql injection-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk erfolgen. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung." } ], "metrics": [ { "cvssV4_0": { "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N", "version": "4.0" } }, { "cvssV3_1": { "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" } }, { "cvssV3_0": { "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.0" } }, { "cvssV2_0": { "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-89", "description": "SQL Injection", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-11-03T14:31:04.727Z", "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB" }, "references": [ { "name": "VDB-282905 | Codezips Free Exam Hall Seating Management System student.php sql injection", "tags": [ "vdb-entry", "technical-description" ], "url": "https://vuldb.com/?id.282905" }, { "name": "VDB-282905 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": [ "signature", "permissions-required" ], "url": "https://vuldb.com/?ctiid.282905" }, { "name": "Submit #435425 | Codezips Free Exam Hall Seating Management System 1.0 SQL Injection", "tags": [ "third-party-advisory" ], "url": "https://vuldb.com/?submit.435425" }, { "tags": [ "exploit", "issue-tracking" ], "url": "https://github.com/EddieAy/cve/issues/3" } ], "timeline": [ { "lang": "en", "time": "2024-11-02T00:00:00.000Z", "value": "Advisory disclosed" }, { "lang": "en", "time": "2024-11-02T01:00:00.000Z", "value": "VulDB entry created" }, { "lang": "en", "time": "2024-11-02T19:18:24.000Z", "value": "VulDB entry last update" } ], "title": "Codezips Free Exam Hall Seating Management System student.php sql injection" } }, "cveMetadata": { "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "assignerShortName": "VulDB", "cveId": "CVE-2024-10736", "datePublished": "2024-11-03T14:31:04.727Z", "dateReserved": "2024-11-02T18:13:16.787Z", "dateUpdated": "2024-11-04T20:20:17.861Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-10766
Vulnerability from cvelistv5
Published
2024-11-04 17:31
Modified
2024-11-04 18:30
Severity ?
5.3 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
6.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
6.3 (Medium) - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
6.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
6.3 (Medium) - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
EPSS score ?
Summary
A vulnerability, which was classified as critical, has been found in Codezips Free Exam Hall Seating Management System 1.0. This issue affects some unknown processing of the file /pages/save_user.php. The manipulation of the argument image leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The initial researcher disclosure contains confusing vulnerability classes and file names.
References
▼ | URL | Tags |
---|---|---|
https://vuldb.com/?id.282953 | vdb-entry, technical-description | |
https://vuldb.com/?ctiid.282953 | signature, permissions-required | |
https://vuldb.com/?submit.436478 | third-party-advisory | |
https://github.com/Charlotte008/cve/issues/3 | exploit, issue-tracking |
Impacted products
Vendor | Product | Version | |
---|---|---|---|
▼ | Codezips | Free Exam Hall Seating Management System |
Version: 1.0 |
|
{ "containers": { "adp": [ { "affected": [ { "cpes": [ "cpe:2.3:a:codezips:free_exam_hall_seating_management_system:1.0:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "free_exam_hall_seating_management_system", "vendor": "codezips", "versions": [ { "status": "affected", "version": "1.0" } ] } ], "metrics": [ { "other": { "content": { "id": "CVE-2024-10766", "options": [ { "Exploitation": "poc" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-11-04T18:28:05.373895Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-11-04T18:30:25.484Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "Free Exam Hall Seating Management System", "vendor": "Codezips", "versions": [ { "status": "affected", "version": "1.0" } ] } ], "credits": [ { "lang": "en", "type": "reporter", "value": "Tiki (VulDB User)" } ], "descriptions": [ { "lang": "en", "value": "A vulnerability, which was classified as critical, has been found in Codezips Free Exam Hall Seating Management System 1.0. This issue affects some unknown processing of the file /pages/save_user.php. The manipulation of the argument image leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The initial researcher disclosure contains confusing vulnerability classes and file names." }, { "lang": "de", "value": "Eine Schwachstelle wurde in Codezips Free Exam Hall Seating Management System 1.0 entdeckt. Sie wurde als kritisch eingestuft. Betroffen davon ist ein unbekannter Prozess der Datei /pages/save_user.php. Dank der Manipulation des Arguments image mit unbekannten Daten kann eine unrestricted upload-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs kann dabei \u00fcber das Netzwerk erfolgen. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung." } ], "metrics": [ { "cvssV4_0": { "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N", "version": "4.0" } }, { "cvssV3_1": { "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" } }, { "cvssV3_0": { "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.0" } }, { "cvssV2_0": { "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-434", "description": "Unrestricted Upload", "lang": "en", "type": "CWE" } ] }, { "descriptions": [ { "cweId": "CWE-284", "description": "Improper Access Controls", "lang": "en", "type": "CWE" } ] }, { "descriptions": [ { "cweId": "CWE-266", "description": "Incorrect Privilege Assignment", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-11-04T17:31:04.507Z", "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB" }, "references": [ { "name": "VDB-282953 | Codezips Free Exam Hall Seating Management System save_user.php unrestricted upload", "tags": [ "vdb-entry", "technical-description" ], "url": "https://vuldb.com/?id.282953" }, { "name": "VDB-282953 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": [ "signature", "permissions-required" ], "url": "https://vuldb.com/?ctiid.282953" }, { "name": "Submit #436478 | Codezips Free Exam Hall Seating Management System In PHP with Source Code V1.0 SQL Injection", "tags": [ "third-party-advisory" ], "url": "https://vuldb.com/?submit.436478" }, { "tags": [ "exploit", "issue-tracking" ], "url": "https://github.com/Charlotte008/cve/issues/3" } ], "timeline": [ { "lang": "en", "time": "2024-11-04T00:00:00.000Z", "value": "Advisory disclosed" }, { "lang": "en", "time": "2024-11-04T01:00:00.000Z", "value": "VulDB entry created" }, { "lang": "en", "time": "2024-11-04T10:56:13.000Z", "value": "VulDB entry last update" } ], "title": "Codezips Free Exam Hall Seating Management System save_user.php unrestricted upload" } }, "cveMetadata": { "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "assignerShortName": "VulDB", "cveId": "CVE-2024-10766", "datePublished": "2024-11-04T17:31:04.507Z", "dateReserved": "2024-11-04T09:51:10.233Z", "dateUpdated": "2024-11-04T18:30:25.484Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }