A vulnerability was found in Project Worlds Student Project Allocation System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /student/project_selection/move_up_project.php of the component Project Selection Page. The manipulation of the argument up leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
History

Tue, 29 Oct 2024 13:30:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:phpgurukul:student_project_allocation_system:1.0:*:*:*:*:*:*:* cpe:2.3:a:projectworlds:student_project_allocation_system:1.0:*:*:*:*:*:*:*
Vendors & Products Phpgurukul
Phpgurukul student Project Allocation System

Tue, 29 Oct 2024 01:15:00 +0000

Type Values Removed Values Added
First Time appeared Phpgurukul
Phpgurukul student Project Allocation System
CPEs cpe:2.3:a:phpgurukul:student_project_allocation_system:1.0:*:*:*:*:*:*:*
Vendors & Products Phpgurukul
Phpgurukul student Project Allocation System

Mon, 28 Oct 2024 13:15:00 +0000

Type Values Removed Values Added
First Time appeared Projectworlds
Projectworlds student Project Allocation System
CPEs cpe:2.3:a:projectworlds:student_project_allocation_system:*:*:*:*:*:*:*:*
Vendors & Products Projectworlds
Projectworlds student Project Allocation System
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


Sun, 27 Oct 2024 19:15:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in Project Worlds Student Project Allocation System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /student/project_selection/move_up_project.php of the component Project Selection Page. The manipulation of the argument up leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Title Project Worlds Student Project Allocation System Project Selection Page move_up_project.php sql injection
Weaknesses CWE-89
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N'}


cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2024-10-27T19:00:06.059Z

Updated: 2024-10-28T13:09:38.668Z

Reserved: 2024-10-26T14:07:16.436Z

Link: CVE-2024-10425

cve-icon Vulnrichment

Updated: 2024-10-28T13:09:33.745Z

cve-icon NVD

Status : Analyzed

Published: 2024-10-27T19:15:04.537

Modified: 2024-10-29T13:14:31.863

Link: CVE-2024-10425

cve-icon Redhat

No data.