CVE-2024-12967 MEDIUM

CVE-2024-12967: code-projects Job Recruitment _all_edits.php fln_update sql injection

Vendor Code-Projects
Product Job Recruitment
Weakness CWE-89 · SQLi
Published December 26, 2024
Last update December 30, 2024
View on NVD All CVEs

CVSS base score

6.9/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

What the vulnerability does

01Description

A vulnerability classified as critical has been found in code-projects Job Recruitment 1.0. Affected is the function fln_update of the file /_parse/_all_edits.php. The manipulation of the argument fname/lname leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Key dates

02Disclosure timeline

December 26, 2024 CVE published
December 30, 2024 Record updated