SourceCodester Best POS Management System 1.0 /view_order.php id sql injection

EntryHistoryDiffjsonxmlCTI

A vulnerability was found in SourceCodester Best POS Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /view_order.php. The manipulation of the argument id leads to sql injection. The CWE definition for the vulnerability is CWE-89. The weakness was published 03/13/2024. The advisory is shared at github.com. This vulnerability is known as CVE-2024-2418. The attack can be launched remotely. Technical details are available. Furthermore, there is an exploit available. The exploit has been disclosed to the public and may be used. The price for an exploit might be around USD $0-$5k at the moment. MITRE ATT&CK project uses the attack technique T1505 for this issue. It is declared as proof-of-concept. It is possible to download the exploit at github.com. We expect the 0-day to have been worth approximately $0-$5k. A possible mitigation has been published even before and not after the disclosure of the vulnerability.

Timeline

The analysis of the timeline helps to identify the required approach and handling of single vulnerabilities and vulnerability collections. This overview makes it possible to see less important slices and more severe hotspots at a glance. Initiating immediate vulnerability response and prioritizing of issues is possible.

User

1	39

Field

vulnerability_cvss3_meta_tempscore	2
vulnerability_cvss3_cna_basescore	1
vulnerability_cvss2_nvd_basescore	1
source_cve_cna	1
vulnerability_cvss3_cna_a	1

Commit Conf

90%	30
70%	21
50%	15
80%	9

Approve Conf

90%	30
80%	28
70%	17

ID	Commited	User	Field	Change	Remarks	Accepted	Status	C
16010895	04/15/2024	VulD...	cvss3_cna_basescore	6.3	see CVSS documentation	04/15/2024	accepted	80
16010894	04/15/2024	VulD...	cvss2_nvd_basescore	6.5	nist.gov	04/15/2024	accepted	80
16010893	04/15/2024	VulD...	cvss3_meta_tempscore	6.0	see CVSS documentation	04/15/2024	accepted	80
16010892	04/15/2024	VulD...	cve_cna	VulDB	nvd.nist.gov	04/15/2024	accepted	70
16010891	04/15/2024	VulD...	cvss3_cna_a	L	nvd.nist.gov	04/15/2024	accepted	70
16010890	04/15/2024	VulD...	cvss3_cna_i	L	nvd.nist.gov	04/15/2024	accepted	70
16010889	04/15/2024	VulD...	cvss3_cna_c	L	nvd.nist.gov	04/15/2024	accepted	70
16010888	04/15/2024	VulD...	cvss3_cna_s	U	nvd.nist.gov	04/15/2024	accepted	70
16010887	04/15/2024	VulD...	cvss3_cna_ui	N	nvd.nist.gov	04/15/2024	accepted	70
16010886	04/15/2024	VulD...	cvss3_cna_pr	L	nvd.nist.gov	04/15/2024	accepted	70
16010885	04/15/2024	VulD...	cvss3_cna_ac	L	nvd.nist.gov	04/15/2024	accepted	70
16010884	04/15/2024	VulD...	cvss3_cna_av	N	nvd.nist.gov	04/15/2024	accepted	70
16010883	04/15/2024	VulD...	cvss2_nvd_ai	P	nvd.nist.gov	04/15/2024	accepted	70
16010882	04/15/2024	VulD...	cvss2_nvd_ii	P	nvd.nist.gov	04/15/2024	accepted	70
16010881	04/15/2024	VulD...	cvss2_nvd_ci	P	nvd.nist.gov	04/15/2024	accepted	70
16010880	04/15/2024	VulD...	cvss2_nvd_au	S	nvd.nist.gov	04/15/2024	accepted	70
16010879	04/15/2024	VulD...	cvss2_nvd_ac	L	nvd.nist.gov	04/15/2024	accepted	70
16010878	04/15/2024	VulD...	cvss2_nvd_av	N	nvd.nist.gov	04/15/2024	accepted	70
16010877	04/15/2024	VulD...	cvss4_vuldb_btscore	2.1	see CVSS documentation	04/15/2024	accepted	80
16010876	04/15/2024	VulD...	cvss4_vuldb_bscore	5.3	see CVSS documentation	04/15/2024	accepted	80