CVE-2024-8343

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-8343
A vulnerability, which was classified as critical, was found in SourceCodester Sentiment Based Movie Rating System 1.0. Affected is an unknown function of the file /classes/Users.php?f=save_client of the component User Registration Handler. The manipulation of the argument email leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.5 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
https://github.com/gurudattch/CVEs/blob/main/Sourcecodester-SQLi-Sentiment-Based-Moive-Rating.md Exploit
https://vuldb.com/?ctiid.276222 Permissions Required
https://vuldb.com/?id.276222 Third Party Advisory VDB Entry
https://vuldb.com/?submit.399711 Third Party Advisory VDB Entry
https://www.sourcecodester.com/ Product
Configurations

Configuration 1 (hide)

cpe:2.3:a:oretnom23:sentiment_based_movie_rating_system:1.0:*:*:*:*:*:*:*
History

04 Sep 2024, 16:34

Type Values Removed Values Added
First Time Oretnom23 sentiment Based Movie Rating System
Oretnom23
References () https://github.com/gurudattch/CVEs/blob/main/Sourcecodester-SQLi-Sentiment-Based-Moive-Rating.md - () https://github.com/gurudattch/CVEs/blob/main/Sourcecodester-SQLi-Sentiment-Based-Moive-Rating.md - Exploit
References () https://vuldb.com/?ctiid.276222 - () https://vuldb.com/?ctiid.276222 - Permissions Required
References () https://vuldb.com/?id.276222 - () https://vuldb.com/?id.276222 - Third Party Advisory, VDB Entry
References () https://vuldb.com/?submit.399711 - () https://vuldb.com/?submit.399711 - Third Party Advisory, VDB Entry
References () https://www.sourcecodester.com/ - () https://www.sourcecodester.com/ - Product
CVSS v2 : 7.5
v3 : 7.3 		v2 : 7.5
v3 : 9.8
CPE cpe:2.3:a:oretnom23:sentiment_based_movie_rating_system:1.0:*:*:*:*:*:*:*

03 Sep 2024, 12:59

Type Values Removed Values Added
Summary
  • (es) Se ha encontrado una vulnerabilidad clasificada como crítica en SourceCodester Sentiment Based Movie Rating System 1.0. Se trata de una función desconocida del archivo /classes/Users.php?f=save_client del componente User Registration Handler. La manipulación del argumento email provoca una inyección SQL. Es posible lanzar el ataque de forma remota. El exploit ha sido divulgado al público y puede ser utilizado.

30 Aug 2024, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-08-30 16:15

Updated : 2024-09-04 16:34

NVD link : CVE-2024-8343

Mitre link : CVE-2024-8343

CVE.ORG link : CVE-2024-8343

JSON object : View

Products Affected

oretnom23

  • sentiment_based_movie_rating_system
CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')