Critical severity · published Apr 15, 2024
CVE-2024-28556
SQL Injection vulnerability in Sourcecodester php task management system v1.0, allows remote attackers to execute arbitrary code, escalate privileges, and obtain sensitive…
9.8
CVSS
1.2%
EPSS
No
On KEV
Description
SQL Injection vulnerability in Sourcecodester php task management system v1.0, allows remote attackers to execute arbitrary code, escalate privileges, and obtain sensitive information via crafted payload to admin-manage-user.php.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 69% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PT
Php Task Management System · Mayurik
1.0 · source: NVD
TM
Task Management System · Task Management System Project
1.0 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-28556
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-28556
Exploit
https://github.com/xuanluansec/vul/blob/main/vul/1/README.md
Exploit
https://github.com/xuanluansec/vul/issues/1
More from Php Task Management System
9.8
CVE-2024-28613
SQL Injection vulnerability in PHP Task Management System v.1.0 allows a remote attacker to escalate privileges and obtain sensitive information via the task_id parameter of the…
9.8
CVE-2024-28557
SQL Injection vulnerability in Sourcecodester php task management system v1.0, allows remote attackers to execute arbitrary code, escalate privileges, and obtain sensitive…
9.8
CVE-2024-29303
The delete admin users function of SourceCodester PHP Task Management System 1.0 is vulnerable to SQL Injection
8.8
CVE-2024-3224
SourceCodester PHP Task Management System task-details.php sql injection
8.8
CVE-2024-3223
SourceCodester PHP Task Management System admin-manage-user.php sql injection