Codezips Hospital Appointment System 1.0 SQL Injection Vulnerability (CVE-2024-11057) Analysis

Key Information Vulnerability Description Vulnerability Name: Codezips Hospital Appointment System 1.0 /removeBranchResult.php ID/NAME SQL Injection Vulnerability ID: VDB-283801, CVE-2024-11057 Affected Version: Codezips Hospital Appointment System 1.0 Impact Level: Critical (Severe) CVSS Meta Temp Score: 6.9 Vulnerability Impact Vulnerability Type: SQL Injection (SQLi) Affected File: /removeBranchResult.php Affected Parameters: ID/Name Attack Method: External input is manipulated to construct or partially form SQL commands, and special characters are not properly neutralized, leading to SQL commands being altered when sent to downstream components. Exploitation Exploitation Difficulty: Easy Exploitation Method: Remote attack Exploitation Tools: Publicly available tools Exploitation Details: Publicly disclosed Exploitation Technique: T1505 Vulnerability Disclosure Disclosure Time: Publicly disclosed Disclosure Platform: GitHub Disclosure Link: GitHub Exploitation Exploitation Link: GitHub Exploitation Description: Publicly available exploitation tools and details Remediation Recommendation: Use alternative products Related Vulnerabilities: VDB-249359, VDB-282921 Additional Information CVE ID: CVE-2024-11057 Affected Scope: Public Impact: May compromise confidentiality, integrity, and availability of the system Summary This vulnerability is a severe SQL injection flaw affecting the file in Codezips Hospital Appointment System 1.0. Exploiting this vulnerability allows attackers to remotely execute SQL commands, potentially compromising the confidentiality, integrity, and availability of the system. Affected users are advised to promptly upgrade to the latest version or switch to alternative products to mitigate this vulnerability.

Goal Reached Thanks to every supporter — we hit 100%!

Codezips Hospital Appointment System 1.0 SQL Injection Vulnerability (CVE-2024-11057) Analysis