CVE-2024-5099: SourceCodester Simple Inventory System updateprice.php sql injection
A vulnerability was found in SourceCodester Simple Inventory System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file updateprice.php. The manipulation of the argument ITEM leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-265082 is the identifier assigned to this vulnerability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Because the vulnerability is an SQL injection via the ITEM argument in file updateprice.php (remote attack), place compensating controls to restrict access to the vulnerable functionality/updateprice.php endpoint (e.g., block/allow at the web server or network so only trusted clients can reach it).
- Operational
Audit application logs for requests targeting updateprice.php/updatepriceprice.php with manipulated ITEM parameters, and rotate/clear any potentially exposed database credentials or application secrets if there is evidence of exploitation.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-5099?
CVE-2024-5099 is classified as a critical vulnerability.
How do I fix CVE-2024-5099?
To fix CVE-2024-5099, ensure that the file updateprice.php is properly secured against SQL injection attacks.
What type of vulnerability is CVE-2024-5099?
CVE-2024-5099 is a SQL injection vulnerability.
Can CVE-2024-5099 be exploited remotely?
Yes, CVE-2024-5099 can be exploited remotely.
What functionality is affected by CVE-2024-5099?
CVE-2024-5099 affects the updateprice.php file in the SourceCodester Simple Inventory System.