Vulnerability · Published Sep 7, 2024 · Assigned by VulDB
CVE-2024-8561SourceCodester PHP CRUD Delete Person delete.php sql injection
Medium 6.3
In plain English
A medium-severity SQL injection in PHP CRUD from SourceCodester. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).
Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)0.4%top 62.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A vulnerability has been found in SourceCodester PHP CRUD 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /endpoint/delete.php of the component Delete Person Handler. The manipulation of the argument person leads to sql injection. The attack can be launched remotely.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SourceCodester | PHP CRUD | 1.0 |
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
References
- VDB-276781 | SourceCodester PHP CRUD Delete Person delete.php sql injection vdb-entry, technical-description
- VDB-276781 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- Submit #403651 | SourceCodester PHP CRUD using PDO Connection with Free Source Code 1.0 SQL Injection third-party-advisory
- https://www.sourcecodester.com/ product