Vulnerability · Published Apr 2, 2024 · Assigned by VulDB
CVE-2024-3151Bdtask Multi-Store Inventory Management System Stock Movement Page cross-site request forgery
Medium 4.3
In plain English
A medium-severity cross-site request forgery in Multi-Store Inventory Management System from Bdtask. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).
Official description
A vulnerability, which was classified as problematic, was found in Bdtask Multi-Store Inventory Management System up to 20240325. Affected is an unknown function of the file /stockmovment/stockmovment/delete/ of the component Stock Movement Page. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-258924. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Bdtask | Multi-Store Inventory Management System | 20240325 |
Weakness: CWE-352 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
References
- VDB-258924 | Bdtask Multi-Store Inventory Management System Stock Movement Page cross-site request forgery vdb-entry
- VDB-258924 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
- Submit #303898 | Bdtask M-Store- Multi-Store Inventory Management System with Full Accounts and installment Sale upto 25032024 CSRF third-party-advisory
- https://drive.google.com/file/d/1oTqULJy357Z4dk85vPR_yMFXRNhwZywX/view?usp=sharing exploit