CVE-2024-1926 — SQL Injection in Free AND Open Source Inventory Management System

CWE-89 — SQL InjectionCWE-415 — Double Free4 documents4 sources
Severity
9.8CRITICALNVD
CNA6.3
EPSS
0.1%
top 70.27%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Sourcecodester Free AND Open Source Inventory Management SystemMayurik Free AND Open Source Inventory Management System
Timeline
PublishedFeb 27
Latest updateSep 18

Description

A vulnerability was found in SourceCodester Free and Open Source Inventory Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /app/ajax/search_sales_report.php. The manipulation of the argument customer leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-254861 was assigned to this vulnerability.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages2 packages

🔴Vulnerability Details

2
CVEList
SourceCodester Free and Open Source Inventory Management System search_sales_report.php sql injection↗2024-02-27
▶
GHSA
GHSA-433j-4wj2-c99m: A vulnerability was found in SourceCodester Free and Open Source Inventory Management System 1↗2024-02-27
▶

📋Vendor Advisories

1
Red Hat
kernel: misc: fastrpc: Fix double free of 'buf' in error path↗2024-09-18
▶
CVE-2024-1926 — SQL Injection | cvebase