CVE-2024-37858: SQL Injection
Published Jul 29, 2024
·Updated
SQL Injection vulnerability in Lost and Found Information System 1.0 allows a remote attacker to escalate privileges via the id parameter to php-lfis/admin/categories/managecategory.php.
Affected Software
2 affected components
oretnom23 Lost And Found Information System=1.0
Lost and Found Information System Lost and Found Information System
Event History
Jul 29, 2024
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·07:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2024-37858?
The CVE-2024-37858 vulnerability is classified as a high severity SQL Injection vulnerability.
2
How does CVE-2024-37858 allow privilege escalation?
CVE-2024-37858 allows a remote attacker to escalate privileges through the id parameter in the manage_category.php script.
3
What software versions are affected by CVE-2024-37858?
CVE-2024-37858 affects Lost and Found Information System version 1.0.
4
How can I exploit CVE-2024-37858?
An attacker can exploit CVE-2024-37858 by manipulating the id parameter in HTTP requests to execute unauthorized SQL commands.
5
What is the recommended way to mitigate CVE-2024-37858?
To mitigate CVE-2024-37858, it is recommended to validate and sanitize user inputs and upgrade to a patched version of the software.