CVE-2024-3151

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-3151
A vulnerability, which was classified as problematic, was found in Bdtask Multi-Store Inventory Management System up to 20240325. Affected is an unknown function of the file /stockmovment/stockmovment/delete/ of the component Stock Movement Page. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-258924. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

4.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

5.0 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References
Link Resource
https://drive.google.com/file/d/1oTqULJy357Z4dk85vPR_yMFXRNhwZywX/view?usp=sharing Exploit
https://vuldb.com/?ctiid.258924 Permissions Required VDB Entry
https://vuldb.com/?id.258924 Third Party Advisory VDB Entry
https://vuldb.com/?submit.303898 Third Party Advisory VDB Entry
https://drive.google.com/file/d/1oTqULJy357Z4dk85vPR_yMFXRNhwZywX/view?usp=sharing Exploit
https://vuldb.com/?ctiid.258924 Permissions Required VDB Entry
https://vuldb.com/?id.258924 Third Party Advisory VDB Entry
https://vuldb.com/?submit.303898 Third Party Advisory VDB Entry
Configurations

Configuration 1 (hide)

cpe:2.3:a:bdtask:m-store:-:*:*:*:*:*:*:*
History

27 Jun 2025, 18:29

Type Values Removed Values Added
First Time Bdtask
Bdtask m-store
References () https://drive.google.com/file/d/1oTqULJy357Z4dk85vPR_yMFXRNhwZywX/view?usp=sharing - () https://drive.google.com/file/d/1oTqULJy357Z4dk85vPR_yMFXRNhwZywX/view?usp=sharing - Exploit
References () https://vuldb.com/?ctiid.258924 - () https://vuldb.com/?ctiid.258924 - Permissions Required, VDB Entry
References () https://vuldb.com/?id.258924 - () https://vuldb.com/?id.258924 - Third Party Advisory, VDB Entry
References () https://vuldb.com/?submit.303898 - () https://vuldb.com/?submit.303898 - Third Party Advisory, VDB Entry
CPE cpe:2.3:a:bdtask:m-store:-:*:*:*:*:*:*:*

21 Nov 2024, 09:29

Type Values Removed Values Added
References () https://drive.google.com/file/d/1oTqULJy357Z4dk85vPR_yMFXRNhwZywX/view?usp=sharing - () https://drive.google.com/file/d/1oTqULJy357Z4dk85vPR_yMFXRNhwZywX/view?usp=sharing -
References () https://vuldb.com/?ctiid.258924 - () https://vuldb.com/?ctiid.258924 -
References () https://vuldb.com/?id.258924 - () https://vuldb.com/?id.258924 -
References () https://vuldb.com/?submit.303898 - () https://vuldb.com/?submit.303898 -

11 Apr 2024, 01:25

Type Values Removed Values Added
Summary
  • (es) Una vulnerabilidad clasificada como problemática ha sido encontrada en Bdtask Multi-Store Inventory Management System hasta 20240325. Una función desconocida del archivo /stockmovment/stockmovment/delete/ del componente Stock Movement Page es afectada por esta vulnerabilidad. La manipulación conduce a Cross-Site Request Forgery. Es posible lanzar el ataque de forma remota. El exploit ha sido divulgado al público y puede utilizarse. El identificador de esta vulnerabilidad es VDB-258924. NOTA: Se contactó primeramente al proveedor sobre esta divulgación, pero no respondió de ninguna manera.

02 Apr 2024, 17:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-04-02 17:15

Updated : 2025-06-27 18:29

NVD link : CVE-2024-3151

Mitre link : CVE-2024-3151

CVE.ORG link : CVE-2024-3151

JSON object : View

Products Affected

bdtask

  • m-store
CWE
CWE-352

Cross-Site Request Forgery (CSRF)