CVE-2024-3620
published 2024-04-11CVE-2024-3620: A vulnerability was found in SourceCodester Kortex Lite Advocate Office Management System 1.0 and classified as critical. Affected by this issue is some…
PriorityP346high7.2CVSS 3.1
AVNACLPRHUINSUCHIHAH
EPSS
0.63%
46.2th percentile
A vulnerability was found in SourceCodester Kortex Lite Advocate Office Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /control/adds.php. The manipulation of the argument name/gender/dob/email/mobile/address leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-260276.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| drupal | tacjs | — | — |
| mayurik | advocate_office_management_system | — | — |
| sourcecodester | kortex_lite_advocate_office_management_system | — | — |
CVSS provenance
nvdv3.17.2HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
nvdv2.05.8MEDIUMAV:N/AC:L/Au:M/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-7vmh-44jh-j67q: A vulnerability was found in SourceCodester Kortex Lite Advocate Office Management System 1
ghsa_unreviewed·2024-04-11
CVE-2024-3620 [MEDIUM] CWE-89 GHSA-7vmh-44jh-j67q: A vulnerability was found in SourceCodester Kortex Lite Advocate Office Management System 1
A vulnerability was found in SourceCodester Kortex Lite Advocate Office Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /control/adds.php. The manipulation of the argument name/gender/dob/email/mobile/address leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-260276.
Drupal
TacJS - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-016
vendor_drupal·2024-03-27·CVSS 5.4
CVE-2024-13252 [MEDIUM] TacJS - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-016
Title: TacJS - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-016
Vulnerability Type: Cross Site Scripting
Description: This module enables sites to comply with the European cookie law using tarteaucitron.js. The module doesn't sufficiently filter user-supplied markup inside of content leading to a persistent Cross Site Scripting (XSS) vulnerability. More details are available in CVE-2023-3620 . This vulnerability is mitigated by the fact that an attacker needs to be able to write content in the page, a feature commonly available on Drupal sites.
Solution: Install the latest version: If you use the tacjs module for Drupal 8.x, upgrade to tacjs 8.x-6.5
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/zyairelai/CVE-submissions/blob/main/kortex-adds-sqli.mdhttps://vuldb.com/?ctiid.260276https://vuldb.com/?id.260276https://vuldb.com/?submit.312815https://github.com/zyairelai/CVE-submissions/blob/main/kortex-adds-sqli.mdhttps://vuldb.com/?ctiid.260276https://vuldb.com/?id.260276https://vuldb.com/?submit.312815
2024-04-11
Published