CVE-2024-13204

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-13204
A vulnerability was found in kurniaramadhan E-Commerce-PHP 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /blog-details.php. The manipulation of the argument blog_id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.1 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

6.5 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 8.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
https://vuldb.com/?ctiid.290797 Permissions Required VDB Entry
https://vuldb.com/?id.290797 Third Party Advisory VDB Entry
https://www.websecurityinsights.my.id/2024/12/ecommerce-php-by-kurniaramadhan-sql.html?m=1 Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:kurniaramadhan:e-commerce-php:1.0:*:*:*:*:*:*:*
History

02 Jul 2025, 19:10

Type Values Removed Values Added
Summary
  • (es) Se ha encontrado una vulnerabilidad en kurniaramadhan E-Commerce-PHP 1.0. Se ha declarado como crítica. Esta vulnerabilidad afecta a una funcionalidad desconocida del archivo /blog-details.php. La manipulación del argumento blog_id provoca una inyección SQL. El ataque se puede ejecutar de forma remota. El exploit se ha divulgado al público y puede utilizarse. Se contactó al proveedor con anticipación sobre esta divulgación, pero no respondió de ninguna manera.
References () https://vuldb.com/?ctiid.290797 - () https://vuldb.com/?ctiid.290797 - Permissions Required, VDB Entry
References () https://vuldb.com/?id.290797 - () https://vuldb.com/?id.290797 - Third Party Advisory, VDB Entry
References () https://www.websecurityinsights.my.id/2024/12/ecommerce-php-by-kurniaramadhan-sql.html?m=1 - () https://www.websecurityinsights.my.id/2024/12/ecommerce-php-by-kurniaramadhan-sql.html?m=1 - Exploit, Third Party Advisory
CPE cpe:2.3:a:kurniaramadhan:e-commerce-php:1.0:*:*:*:*:*:*:*
First Time Kurniaramadhan
Kurniaramadhan e-commerce-php

09 Jan 2025, 03:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-01-09 03:15

Updated : 2025-07-02 19:10

NVD link : CVE-2024-13204

Mitre link : CVE-2024-13204

CVE.ORG link : CVE-2024-13204

JSON object : View

Products Affected

kurniaramadhan

  • e-commerce-php
CWE
CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')