Vulnerability · Published Jan 12, 2024 · Assigned by VulDB
CVE-2024-0473code-projects Dormitory Management System comment.php sql injection
Medium 6.3
In plain English
A medium-severity SQL injection in Dormitory Management System from code-projects. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).
Official description
A vulnerability classified as critical has been found in code-projects Dormitory Management System 1.0. Affected is an unknown function of the file comment.php. The manipulation of the argument com leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-250578 is the identifier assigned to this vulnerability.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| code-projects | Dormitory Management System | 1.0 |
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
References
- https://vuldb.com/?id.250578 vdb-entry, technical-description
- https://vuldb.com/?ctiid.250578 signature, permissions-required
- https://github.com/yingqian1984/FirePunch/blob/main/7-Dormitory%20Management%20System%20has%20SQL%20injection%20vulnerabilities%20comment.php.pdf broken-link, exploit