Description

A vulnerability was found in 1000 Projects Beauty Parlour Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/edit-customer-detailed.php. The manipulation of the argument name leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Es wurde eine kritische Schwachstelle in 1000 Projects Beauty Parlour Management System 1.0 ausgemacht. Es betrifft eine unbekannte Funktion der Datei /admin/edit-customer-detailed.php. Dank Manipulation des Arguments name mit unbekannten Daten kann eine sql injection-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk erfolgen. Der Exploit steht zur öffentlichen Verfügung.

Classification

CVE ID: CVE-2024-12234

CVSS Base Severity: MEDIUM

CVSS Base Score: 6.9

Affected Products

Vendor: 1000 Projects

Product: Beauty Parlour Management System

Exploit Prediction Scoring System (EPSS)

EPSS Score: 0.17% (probability of being exploited)

EPSS Percentile: 54.11% (scored less or equal to compared to others)

EPSS Date: 2025-02-03 (when was this score calculated)

References

https://vuldb.com/?id.286980
https://vuldb.com/?ctiid.286980
https://vuldb.com/?submit.456519
https://github.com/Hacker0xone/CVE/issues/17
https://1000projects.org/

Timeline