Code-Projects Hospital Management System 1.0 Login SQL Injection (CVE-2024-8368)

Key Information 1. Vulnerability ID: - VDB-276272 - CVE-2024-8368 2. Vulnerability Name: - Code-Projects Hospital Management System 1.0 Login Index.php Username SQL Injection 3. CVSS Meta Temp Score: - 6.9 4. Current Vulnerability Price: - $0-$5k 5. CTI Interest Score: - 3.92 6. Affected Component: - code-projects Hospital Management System 1.0 - Login 7. Affected File: - index.php 8. Vulnerability Description: - The vulnerability exists in the Login component of the index.php file, where it accepts unknown input via the username parameter, leading to an SQL injection vulnerability. - The issue is described using CWE-89. - The product constructs SQL commands using external, untrusted input without properly neutralizing or failing to neutralize special elements, which may allow downstream components to alter SQL commands. - Impacts confidentiality, integrity, and availability. 9. Exploitability: - Can be exploited remotely. ronounced, and may be exploited. 10. Vulnerability ID: - CVE-2024-8368 11. Vulnerability Type: - SQL Injection 12. Vulnerability Severity: - Critical 13. Exploit Difficulty: - Easy 14. Exploit Method: - No authentication required 15. Technical Details: - Publicly disclosed 16. MITRE ATT&CK Technique: - T1505 17. Exploit Tools: - Proof-of-concept - Vulnerable targets can be found via Google Hacking searches for index.php 18. Recommended Actions: - Affected components may need to be replaced 19. Related Vulnerabilities: - VDB-268901, VDB-269162, VDB-269620, VDB-270392 Summary This vulnerability is a critical SQL injection flaw located in the Login component's index.php file of the Code-Projects Hospital Management System 1.0. Exploiting this vulnerability allows attackers to remotely execute SQL commands, potentially leading to unauthorized access to sensitive data or system compromise. It is recommended to remediate this vulnerability as soon as possible to mitigate potential security risks.

Goal Reached Thanks to every supporter — we hit 100%!

Code-Projects Hospital Management System 1.0 Login SQL Injection (CVE-2024-8368)