From 11858cf32861fa4b978dc3295e72bceff2b35884 Mon Sep 17 00:00:00 2001 From: cvelistV5 Github Action Date: Mon, 25 Nov 2024 01:01:17 +0000 Subject: [PATCH] 1 changes (1 new | 0 updated): - 1 new CVEs: CVE-2024-11648 - 0 updated CVEs: --- cves/2024/11xxx/CVE-2024-11648.json | 162 ++++++++++++++++++++++++++++ cves/delta.json | 45 ++------ cves/deltaLog.json | 14 +++ 3 files changed, 183 insertions(+), 38 deletions(-) create mode 100644 cves/2024/11xxx/CVE-2024-11648.json diff --git a/cves/2024/11xxx/CVE-2024-11648.json b/cves/2024/11xxx/CVE-2024-11648.json new file mode 100644 index 000000000000..43c8e3678b1b --- /dev/null +++ b/cves/2024/11xxx/CVE-2024-11648.json @@ -0,0 +1,162 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.1", + "cveMetadata": { + "cveId": "CVE-2024-11648", + "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", + "state": "PUBLISHED", + "assignerShortName": "VulDB", + "dateReserved": "2024-11-24T15:01:35.647Z", + "datePublished": "2024-11-25T01:00:14.754Z", + "dateUpdated": "2024-11-25T01:00:14.754Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", + "shortName": "VulDB", + "dateUpdated": "2024-11-25T01:00:14.754Z" + }, + "title": "1000 Projects Beauty Parlour Management System add-customer.php sql injection", + "problemTypes": [ + { + "descriptions": [ + { + "type": "CWE", + "cweId": "CWE-89", + "lang": "en", + "description": "SQL Injection" + } + ] + }, + { + "descriptions": [ + { + "type": "CWE", + "cweId": "CWE-74", + "lang": "en", + "description": "Injection" + } + ] + } + ], + "affected": [ + { + "vendor": "1000 Projects", + "product": "Beauty Parlour Management System", + "versions": [ + { + "version": "1.0", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A vulnerability, which was classified as critical, was found in 1000 Projects Beauty Parlour Management System 1.0. This affects an unknown part of the file /admin/add-customer.php. The manipulation of the argument name leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used." + }, + { + "lang": "de", + "value": "Es wurde eine kritische Schwachstelle in 1000 Projects Beauty Parlour Management System 1.0 gefunden. Betroffen hiervon ist ein unbekannter Ablauf der Datei /admin/add-customer.php. Mit der Manipulation des Arguments name mit unbekannten Daten kann eine sql injection-Schwachstelle ausgenutzt werden. Umgesetzt werden kann der Angriff über das Netzwerk. Der Exploit steht zur öffentlichen Verfügung." + } + ], + "metrics": [ + { + "cvssV4_0": { + "version": "4.0", + "baseScore": 6.9, + "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N", + "baseSeverity": "MEDIUM" + } + }, + { + "cvssV3_1": { + "version": "3.1", + "baseScore": 7.3, + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", + "baseSeverity": "HIGH" + } + }, + { + "cvssV3_0": { + "version": "3.0", + "baseScore": 7.3, + "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", + "baseSeverity": "HIGH" + } + }, + { + "cvssV2_0": { + "version": "2.0", + "baseScore": 7.5, + "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P" + } + } + ], + "timeline": [ + { + "time": "2024-11-24T00:00:00.000Z", + "lang": "en", + "value": "Advisory disclosed" + }, + { + "time": "2024-11-24T01:00:00.000Z", + "lang": "en", + "value": "VulDB entry created" + }, + { + "time": "2024-11-24T16:06:47.000Z", + "lang": "en", + "value": "VulDB entry last update" + } + ], + "credits": [ + { + "lang": "en", + "value": "Calmgh06 (VulDB User)", + "type": "reporter" + } + ], + "references": [ + { + "url": "https://vuldb.com/?id.285969", + "name": "VDB-285969 | 1000 Projects Beauty Parlour Management System add-customer.php sql injection", + "tags": [ + "vdb-entry", + "technical-description" + ] + }, + { + "url": "https://vuldb.com/?ctiid.285969", + "name": "VDB-285969 | CTI Indicators (IOB, IOC, TTP, IOA)", + "tags": [ + "signature", + "permissions-required" + ] + }, + { + "url": "https://vuldb.com/?submit.447291", + "name": "Submit #447291 | 1000 Projects Beauty Parlour Management System PHP SQLite Project V1.0 SQL Injection", + "tags": [ + "third-party-advisory" + ] + }, + { + "url": "https://github.com/Calmgh/CVE/issues/1", + "tags": [ + "exploit", + "issue-tracking" + ] + }, + { + "url": "https://1000projects.org/", + "tags": [ + "product" + ] + } + ] + } + } +} \ No newline at end of file diff --git a/cves/delta.json b/cves/delta.json index 9ac1b8d80044..60da9a9791c3 100644 --- a/cves/delta.json +++ b/cves/delta.json @@ -1,45 +1,14 @@ { - "fetchTime": "2024-11-25T00:34:17.824Z", - "numberOfChanges": 6, + "fetchTime": "2024-11-25T01:01:06.766Z", + "numberOfChanges": 1, "new": [ { - "cveId": "CVE-2024-11647", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2024-11647", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11647.json", - "dateUpdated": "2024-11-25T00:31:06.139Z" - } - ], - "updated": [ - { - "cveId": "CVE-2024-10041", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2024-10041", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/10xxx/CVE-2024-10041.json", - "dateUpdated": "2024-11-25T00:16:22.815Z" - }, - { - "cveId": "CVE-2024-3727", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2024-3727", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/3xxx/CVE-2024-3727.json", - "dateUpdated": "2024-11-25T00:26:05.702Z" - }, - { - "cveId": "CVE-2024-7409", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2024-7409", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/7xxx/CVE-2024-7409.json", - "dateUpdated": "2024-11-25T00:20:57.035Z" - }, - { - "cveId": "CVE-2024-9407", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2024-9407", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/9xxx/CVE-2024-9407.json", - "dateUpdated": "2024-11-25T00:32:41.970Z" - }, - { - "cveId": "CVE-2024-9676", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2024-9676", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/9xxx/CVE-2024-9676.json", - "dateUpdated": "2024-11-25T00:32:44.061Z" + "cveId": "CVE-2024-11648", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2024-11648", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11648.json", + "dateUpdated": "2024-11-25T01:00:14.754Z" } ], + "updated": [], "error": [] } \ No newline at end of file diff --git a/cves/deltaLog.json b/cves/deltaLog.json index c17df492f168..e578da06be6c 100644 --- a/cves/deltaLog.json +++ b/cves/deltaLog.json @@ -1,4 +1,18 @@ [ + { + "fetchTime": "2024-11-25T01:01:06.766Z", + "numberOfChanges": 1, + "new": [ + { + "cveId": "CVE-2024-11648", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2024-11648", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11648.json", + "dateUpdated": "2024-11-25T01:00:14.754Z" + } + ], + "updated": [], + "error": [] + }, { "fetchTime": "2024-11-25T00:34:17.824Z", "numberOfChanges": 6,