Medium severity · published Nov 12, 2024
CVE-2024-11096
A vulnerability, which was classified as critical, was found in code-projects Task Manager 1.0
6.5
CVSS
0.5%
EPSS
No
On KEV
Description
A vulnerability, which was classified as critical, was found in code-projects Task Manager 1.0. This affects an unknown part of the file /newProject.php. The manipulation of the argument projectName leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 40% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TM
Task Manager · Code-projects
1.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-11096
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-11096
Product
https://code-projects.org/
Exploit
https://github.com/UnrealdDei/cve/blob/main/sql4.md
Permissions Required
https://vuldb.com/?ctiid.283917
Third Party Advisory
https://vuldb.com/?id.283917
Third Party Advisory
https://vuldb.com/?submit.441186
More from Task Manager
9.8
CVE-2024-25222
Task Manager App v1.0 was discovered to contain a SQL injection vulnerability via the projectID parameter at /TaskManager/EditProject.php
9.8
CVE-2024-25220
Task Manager App v1.0 was discovered to contain a SQL injection vulnerability via the taskID parameter at /TaskManager/EditTask.php
6.1
CVE-2024-25221
A cross-site scripting (XSS) vulnerability in Task Manager App v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Note Section…
6.1
CVE-2024-25219
A cross-site scripting (XSS) vulnerability in Task Manager App v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Task Name…
6.1
CVE-2024-25218
A cross-site scripting (XSS) vulnerability in Task Manager App v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Project Name…