CVE-2024-1702 MEDIUM

CVE-2024-1702: keerti1924 PHP-MYSQL-User-Login-System edit.php sql injection

Vendor Keerti1924

Product PHP-MYSQL-User-Login-System

Weakness CWE-89 · SQLi

Published February 21, 2024

Last update August 1, 2024

View on NVD All CVEs

CVSS base score

6.3/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

What the vulnerability does

01Description

A vulnerability was found in keerti1924 PHP-MYSQL-User-Login-System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /edit.php. The manipulation leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-254390 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Key dates

02Disclosure timeline

February 21, 2024 CVE published

August 1, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-1702 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/89.html AskarLabs — CWE-89 write-up SQL Injection

Related vulnerabilities

04Related CVE

CVE-2026-32471 WordPress ProLancer Element plugin <= 1.4.8 - SQL Injection vulnerability CVE-2026-32466 WordPress Gravity Forms Bookings premium plugin <= 2.1 - SQL Injection vulnerability CVE-2026-66622 WordPress Depicter Slider plugin <= 4.8.0 - SQL Injection vulnerability CVE-2026-16586 Contest Gallery <= 30.0.6 - Authenticated (Author+) Second-Order SQL Injection via MultipleFiles Second-Order Payload via 'cg_multiple_files_for_post' -> 'cgRealId' CVE-2026-16094 Invisible Anti-Spam & CAPTCHA <= 5.1 - Authenticated (Editor+) SQL Injection via 'key' Parameter