SourceCodester Computer Laboratory Management System 1.0 Master.php id sql injection

EntryDiffjsonxmlCTI

A vulnerability was found in SourceCodester Computer Laboratory Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /classes/Master.php?f=save_category. The manipulation of the argument id leads to sql injection. Using CWE to declare the problem leads to CWE-89. The weakness was shared 04/01/2024. The advisory is available at github.com. This vulnerability was named CVE-2024-3131. The attack can be initiated remotely. Technical details are available. Furthermore, there is an exploit available. The exploit has been disclosed to the public and may be used. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment. This vulnerability is assigned to T1505 by the MITRE ATT&CK project. It is declared as proof-of-concept. It is possible to download the exploit at github.com. As 0-day the estimated underground price was around $0-$5k. A possible mitigation has been published even before and not after the disclosure of the vulnerability.

Timeline

The analysis of the timeline helps to identify the required approach and handling of single vulnerabilities and vulnerability collections. This overview makes it possible to see less important slices and more severe hotspots at a glance. Initiating immediate vulnerability response and prioritizing of issues is possible.

User

1	39

Field

vulnerability_cvss3_meta_tempscore	2
vulnerability_cvss3_cna_basescore	1
vulnerability_cvss2_nvd_basescore	1
source_cve_cna	1
vulnerability_cvss3_cna_a	1

Commit Conf

90%	29
70%	26
50%	12
80%	8

Approve Conf

80%	29
90%	29
70%	17

ID	Commited	User	Field	Change	Remarks	Accepted	Status	C
16244293	05/08/2024	VulD...	cvss3_cna_basescore	6.3	see CVSS documentation	05/08/2024	accepted	80
16244292	05/08/2024	VulD...	cvss2_nvd_basescore	6.5	nist.gov	05/08/2024	accepted	80
16244291	05/08/2024	VulD...	cvss3_meta_tempscore	6.0	see CVSS documentation	05/08/2024	accepted	80
16244290	05/08/2024	VulD...	cve_cna	VulDB	nvd.nist.gov	05/08/2024	accepted	70
16244289	05/08/2024	VulD...	cvss3_cna_a	L	nvd.nist.gov	05/08/2024	accepted	70
16244288	05/08/2024	VulD...	cvss3_cna_i	L	nvd.nist.gov	05/08/2024	accepted	70
16244287	05/08/2024	VulD...	cvss3_cna_c	L	nvd.nist.gov	05/08/2024	accepted	70
16244286	05/08/2024	VulD...	cvss3_cna_s	U	nvd.nist.gov	05/08/2024	accepted	70
16244285	05/08/2024	VulD...	cvss3_cna_ui	N	nvd.nist.gov	05/08/2024	accepted	70
16244284	05/08/2024	VulD...	cvss3_cna_pr	L	nvd.nist.gov	05/08/2024	accepted	70
16244283	05/08/2024	VulD...	cvss3_cna_ac	L	nvd.nist.gov	05/08/2024	accepted	70
16244282	05/08/2024	VulD...	cvss3_cna_av	N	nvd.nist.gov	05/08/2024	accepted	70
16244281	05/08/2024	VulD...	cvss2_nvd_ai	P	nvd.nist.gov	05/08/2024	accepted	70
16244280	05/08/2024	VulD...	cvss2_nvd_ii	P	nvd.nist.gov	05/08/2024	accepted	70
16244279	05/08/2024	VulD...	cvss2_nvd_ci	P	nvd.nist.gov	05/08/2024	accepted	70
16244278	05/08/2024	VulD...	cvss2_nvd_au	S	nvd.nist.gov	05/08/2024	accepted	70
16244277	05/08/2024	VulD...	cvss2_nvd_ac	L	nvd.nist.gov	05/08/2024	accepted	70
16244276	05/08/2024	VulD...	cvss2_nvd_av	N	nvd.nist.gov	05/08/2024	accepted	70
16244275	05/08/2024	VulD...	cve_nvd_summary	A vulnerability was found in SourceCodester Computer Laboratory Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /classes/Master.php?f=save_category. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-258874 is the identifier assigned to this vulnerability.	cve.mitre.org	05/08/2024	accepted	70
16244274	05/08/2024	VulD...	cve_assigned	1711922400 (04/01/2024)	cve.mitre.org	05/08/2024	accepted	70