CVE-2024-12949: code-projects Travel Management System package.php sql injection
Published Dec 26, 2024
·Updated
A vulnerability was found in code-projects Travel Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /package.php. The manipulation of the argument subcatid leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Affected Software
2 affected components
Code-projects Travel Management System
Code-projects Travel Management System=1.0
Event History
Dec 26, 2024
CVE Published
via MITRE·11:31 AM
Data Sourced
via MITRE·11:31 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·12:15 PM
DescriptionSeverityWeaknessAffected Software
Oct 27, 57234
Event
via NVD·05:41 AM
Frequently Asked Questions
1
What is the severity of CVE-2024-12949?
CVE-2024-12949 has been declared as a critical vulnerability.
2
What type of vulnerability is CVE-2024-12949?
CVE-2024-12949 is an SQL injection vulnerability.
3
Which file is affected by CVE-2024-12949?
CVE-2024-12949 affects the file /package.php in the Travel Management System.
4
Can CVE-2024-12949 be exploited remotely?
Yes, CVE-2024-12949 can be exploited remotely.
5
How do I fix CVE-2024-12949?
To fix CVE-2024-12949, you should apply proper input validation and use prepared statements in SQL queries.