CVE Radar Logo
CVERadar
CVE Radar Logo
CVERadar

CVE-2024-36673

Critical Severity
Pharmacy\/medical_store_point_of_sale_system_project
SVRS
84/100

CVSSv3
9.8/10

EPSS
0.00039/1

CVE-2024-36673: Critical SQL Injection vulnerability in Sourcecodester Pharmacy/Medical Store Point of Sale System 1.0 via login.php. Attackers can exploit this vulnerability by injecting malicious SQL queries through the email and password parameters due to insufficient input validation. With a SOCRadar Vulnerability Risk Score (SVRS) of 84, this vulnerability requires immediate action. Successful exploitation could lead to unauthorized data access, modification, or even complete system compromise. This vulnerability is especially critical for systems directly handling sensitive patient or financial information. The high SVRS indicates active exploitation or discussions within threat actor communities, making prompt patching or mitigation essential to prevent significant security breaches.

No tags available
CVSS:3.1
AV:N
AC:L
PR:N
UI:N
S:U
C:H
I:H
A:H
2024-06-07

2025-02-13

Indicators of Compromise

No IOCs found for this CVE

Exploits

No exploits found for this CVE

Enhance Your CVE Management with SOCRadar Vulnerability Intelligence
Get comprehensive CVE details, real-time notifications, and proactive threat management all in one platform.
CVE Details
Access comprehensive CVE information instantly
Real-time Tracking
Subscribe to CVEs and get instant updates
Exploit Analysis
Monitor related APT groups and threats
IOC Tracking
Analyze and track CVE-related IOCs

News

CVE-2024-36673 | SourceCodester Pharmacy Medical Store Point of Sale System 1.0 password sql injection (Issue 39)
vuldb.com2024-06-07
CVE-2024-36673 | SourceCodester Pharmacy Medical Store Point of Sale System 1.0 password sql injection (Issue 39) | A vulnerability classified as critical has been found in SourceCodester Pharmacy Medical Store Point of Sale System 1.0. This affects an unknown part. The manipulation of the argument password leads to sql injection. This vulnerability is uniquely identified as CVE-2024-36673. It is possible to initiate
cve-2024-36673
domains
urls
cves

Social Media

@OwenDeveloper @RolltheredDev "Uwuoopsie, CVE-2024-36673 haz been patched successfully!!, sowwy!!!"
0
0
0

Affected Software

Configuration 1
TypeVendorProduct
AppPharmacy\/medical_store_point_of_sale_system_projectpharmacy\/medical_store_point_of_sale_system

References

ReferenceLink
[email protected]https://github.com/CveSecLook/cve/issues/39
GITHUBhttps://github.com/CveSecLook/cve/issues/39

CWE Details

CWE IDCWE NameDescription
CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.

CVE Radar

Real-time CVE Intelligence & Vulnerability Management Platform

CVE Radar provides comprehensive vulnerability intelligence by monitoring CVE databases, security advisories, and threat feeds. Get instant updates on new vulnerabilities, exploit details, and mitigation strategies specific to your assets.

Get Free Vulnerability Intelligence AccessAccess real-time CVE monitoring, exploit analysis, and threat intelligence