CVE-2024-56889: High severity complaint management system vulnerability

Published Feb 6, 2025

Updated

Incorrect access control in the endpoint /admin/mdelete.php of CodeAstro Complaint Management System v1.0 allows unauthorized attackers to arbitrarily delete complaints via modification of the id parameter.

Affected Software

2 affected components

Codeastro Complaint Management System

Codeastro Complaint Management System=1.0

Event History

Feb 6, 2025

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·10:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2024-56889?

CVE-2024-56889 has a high severity level due to its impact on access control and the potential for unauthorized data deletion.

How do I fix CVE-2024-56889?

To fix CVE-2024-56889, implement proper access controls and validation for the id parameter in the /admin/m_delete.php endpoint.

What systems are affected by CVE-2024-56889?

CVE-2024-56889 affects CodeAstro Complaint Management System version 1.0.

Can exploiting CVE-2024-56889 lead to data loss?

Yes, exploiting CVE-2024-56889 allows attackers to arbitrarily delete complaints, leading to potential data loss.

Is there a known mitigation for CVE-2024-56889?

The known mitigation for CVE-2024-56889 is to restrict access to the administrative functions based on user roles.