CVE-2024-10758

published 2024-11-04

CVE-2024-10758: A vulnerability, which was classified as critical, was found in code-projects/anirbandutta9 Content Management System and News-Buzz 1.0. This affects an…

Priority P2 63 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

EXPLOIT

A vulnerability, which was classified as critical, was found in code-projects/anirbandutta9 Content Management System and News-Buzz 1.0. This affects an unknown part of the file /index.php. The manipulation of the argument user_name leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product is distributed under two entirely different names.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
anirbandutta9	content_management_system	—	—
anirbandutta9	news-buzz	—	—
code-projects	content_management_system	—	—
code-projects	news-buzz	—	—

Detection & IOCs extracted from sources · hover to see the quote

url http://localhost/NEWS-BUZZ/index.php↗

path /NEWS-BUZZ/login.php↗

path /NEWS-BUZZ/index.php↗

command ' OR sleep(10)#↗

other user_name=admin%27+or+sleep%2810%29%23&user_password=adminpass&login=↗

• → Monitor POST requests to /NEWS-BUZZ/login.php containing SQL sleep() injection patterns in the user_name parameter, specifically URL-encoded variants such as sleep%2810%29 or the literal ' OR sleep(10)#. ↗
• → Detect time-based blind SQL injection by alerting on HTTP responses to /NEWS-BUZZ/login.php that are delayed by ~10 seconds, consistent with a successful sleep() injection. ↗
• → Flag POST requests to /NEWS-BUZZ/login.php where the user_name field contains single-quote characters or SQL keywords (OR, sleep, #) — the vulnerable parameter is user_name, directly embedded into the SQL query without sanitization. ↗
• → The vulnerable endpoint is /index.php (login form) with the manipulated argument being user_name; alert on SQL injection patterns in this parameter across both /index.php and /login.php paths under the NEWS-BUZZ application root. ↗

• · The product is distributed under two entirely different names (Content Management System and News-Buzz), so detection rules must account for both possible application root paths, not just /NEWS-BUZZ/. ↗
• · The PoC was tested on Windows 11 Pro; deployment environments may differ, potentially affecting path casing or web server behavior. ↗

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v4.0 6.9 MEDIUM CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

nvd v2.0 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P

vendor_redhat 7.8 HIGH

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-89 CWE-416