CVE Radar Logo
CVERadar
CVE Radar Logo
CVERadar

CVE-2024-4795

Medium Severity
SVRS
30/100

CVSSv3
6.3/10

EPSS
0.00135/1

CVE-2024-4795: SQL Injection vulnerability in Campcodes Online Laundry Management System 1.0. This critical flaw allows remote attackers to manipulate the 'id' argument in /manage_user.php to inject SQL commands. Despite a CVSS score of 6.3, the SVRS score of 30 indicates a lower immediate risk. However, the vulnerability has been disclosed publicly, making it easier to exploit, and it is tagged as In The Wild, suggesting active exploitation is possible. Successful exploitation could lead to unauthorized data access, modification, or deletion, potentially compromising the entire system. While not currently deemed a high-priority threat based on SVRS, active monitoring and patching are recommended. The existence of a public exploit increases the likelihood of malicious use. The affected functionality involves user management, making it a sensitive area.

In The Wild
CVSS:3.1
AV:N
AC:L
PR:L
UI:N
S:U
C:L
I:L
A:L
2024-05-14

2024-06-04
Eye Icon
SOCRadar
AI Insight

Description

CVE-2024-4795 is a vulnerability with a CVSS score of 0 and an SVRS of 30, indicating a moderate risk. While a detailed description is not yet available, the vulnerability is actively exploited in the wild, highlighting the need for immediate attention.

Key Insights

  • Exploitation in the Wild: The vulnerability is actively exploited by hackers, making it crucial for organizations to take immediate action to mitigate the risk.
  • Moderate Risk: Despite the CVSS score of 0, the SVRS of 30 suggests that the vulnerability poses a moderate risk to organizations. This is due to the integration of various vulnerability intelligence elements in the SVRS, which provides a more comprehensive assessment of the threat.
  • Unknown Threat Actors: The specific threat actors or APT groups exploiting the vulnerability are currently unknown. However, organizations should be vigilant and monitor for any suspicious activity.

Mitigation Strategies

  • Apply Patches: As soon as patches become available, organizations should prioritize applying them to affected systems to eliminate the vulnerability.
  • Network Segmentation: Implement network segmentation to limit the spread of the vulnerability in case of an attack.
  • Intrusion Detection and Prevention Systems (IDS/IPS): Deploy IDS/IPS solutions to detect and block malicious traffic targeting the vulnerability.
  • User Awareness and Training: Educate users about the vulnerability and best practices to avoid falling victim to phishing or other social engineering attacks.

Additional Information

If users have additional queries regarding this incident, they can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information if necessary.

Indicators of Compromise

No IOCs found for this CVE

Exploits

No exploits found for this CVE

Enhance Your CVE Management with SOCRadar Vulnerability Intelligence
Get comprehensive CVE details, real-time notifications, and proactive threat management all in one platform.
CVE Details
Access comprehensive CVE information instantly
Real-time Tracking
Subscribe to CVEs and get instant updates
Exploit Analysis
Monitor related APT groups and threats
IOC Tracking
Analyze and track CVE-related IOCs

News

No news found for this CVE

Social Media

CVE-2024-4795 A vulnerability was found in Campcodes Online Laundry Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file… https://t.co/hSsum9zp3y
0
0
1

Affected Software

No affected software found for this CVE

References

ReferenceLink
[email protected]https://github.com/yylmm/CVE/blob/main/Online%20Laundry%20Management%20System/sql_manage_user.md
[email protected]https://vuldb.com/?ctiid.263894
[email protected]https://vuldb.com/?id.263894
[email protected]https://vuldb.com/?submit.332537
GITHUBhttps://github.com/yylmm/CVE/blob/main/Online%20Laundry%20Management%20System/sql_manage_user.md

CWE Details

CWE IDCWE NameDescription
CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.

CVE Radar

Real-time CVE Intelligence & Vulnerability Management Platform

CVE Radar provides comprehensive vulnerability intelligence by monitoring CVE databases, security advisories, and threat feeds. Get instant updates on new vulnerabilities, exploit details, and mitigation strategies specific to your assets.

Get Free Vulnerability Intelligence AccessAccess real-time CVE monitoring, exploit analysis, and threat intelligence