CVE-2024-36597

published 2024-06-14

CVE-2024-36597: Aegon Life v1.0 was discovered to contain a SQL injection vulnerability via the client_id parameter at clientStatus.php.

Priority P3 55 high 8.8 CVSS 3.1

AV N AC L PR L UI N S U C H I H A H

EXPLOIT

Aegon Life v1.0 was discovered to contain a SQL injection vulnerability via the client_id parameter at clientStatus.php.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
projectworlds	life_insurance_management_system	—	—

Detection & IOCs extracted from sources · hover to see the quote

path /lims/clientStatus.php↗

command client_id=1511986023%27%20OR%201=1%20--%20a↗

url https://projectworlds.in/life-insurance-management-system-in-php/↗

• → Monitor GET requests to /lims/clientStatus.php containing SQL injection patterns in the client_id parameter, specifically URL-encoded single quotes (%27) followed by OR/comment sequences (e.g., OR 1=1 -- a). ↗
• → Alert on SQL injection payloads in the client_id parameter at clientStatus.php, as this is the confirmed vulnerable injection point. ↗
• → Inspect navigation flow: requests to /clientStatus.php originating from /client.php (via 'Client Status' action) are the expected attack path. ↗

• · The exploit was tested on Linux with the application hosted under the /lims/ path; deployments under a different base path may require adjusted detection rules. ↗
• · Authentication is required prior to exploitation; the attacker must have valid credentials to reach the vulnerable clientStatus.php endpoint. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-89