code-projects Blood Bank Management System 1.0 /file/delete.php bid Falsifikovanje zahteva za unakrsni sajt

Identifikovana je ranjivost klasifikovana kao Problematiиno u code-projects Blood Bank Management System 1.0. Obuhvaćeno je nepoznata funkcija u fajlu /file/delete.php. Promena parametra bid uzrokuje Falsifikovanje zahteva za unakrsni sajt. Korišćenje CWE za deklarisanje problema vodi do CWE-352. Objava slabosti je izvršena 10/28/2024. Obaveštenje je dostupno za preuzimanje na github.com. Ova ranjivost je označena kao CVE-2024-10448. Moguće je pokrenuti napad na daljinu. Napad mora biti izveden unutar lokalne mreže. Tehnički detalji su dostupni. Штавише, експлоит је доступан. Eksploatacija je otkrivena javnosti i može biti iskorišćena. U ovom trenutku, trenutna cena za eksploataciju može iznositi oko USD $0-$5k. Označeno je kao dokaz-of-koncept. Eksploat je dostupan za preuzimanje na github.com. Kao 0-day, procenjena cena na crnom tržištu bila je oko $0-$5k. If you want to get best quality of vulnerability data, you may have to visit VulDB.

3 Promene · 101 Tačke podataka

PoljeKreirali
10/28/2024 07:22		Ažurira 1/2
03/02/2025 22:56		Ažurira 2/2
10/23/2025 23:13
cvss4_vuldb_acLLL
cvss4_vuldb_prNNN
cvss4_vuldb_vcNNN
cvss4_vuldb_viLLL
cvss4_vuldb_vaNNN
cvss4_vuldb_ePPP
cvss2_vuldb_rlNDNDND
cvss3_vuldb_rlXXX
cvss4_vuldb_atNNN
cvss4_vuldb_uiNPP
cvss4_vuldb_scNNN
cvss4_vuldb_siNNN
cvss4_vuldb_saNNN
cvss2_vuldb_basescore5.05.05.0
cvss2_vuldb_tempscore4.34.34.3
cvss3_vuldb_basescore4.34.34.3
cvss3_vuldb_tempscore3.93.93.9
cvss3_meta_basescore4.34.35.0
cvss3_meta_tempscore3.93.94.9
cvss4_vuldb_bscore6.95.35.3
cvss4_vuldb_btscore5.52.12.1
advisory_date1730070000 (10/28/2024)1730070000 (10/28/2024)1730070000 (10/28/2024)
price_0day$0-$5k$0-$5k$0-$5k
software_vendorcode-projectscode-projectscode-projects
software_nameBlood Bank Management SystemBlood Bank Management SystemBlood Bank Management System
software_version1.01.01.0
software_file/file/delete.php/file/delete.php/file/delete.php
software_argumentbidbidbid
vulnerability_cweCWE-352 (Falsifikovanje zahteva za unakrsni sajt)CWE-352 (Falsifikovanje zahteva za unakrsni sajt)CWE-352 (Falsifikovanje zahteva za unakrsni sajt)
vulnerability_risk111
cvss3_vuldb_avNNN
cvss3_vuldb_acLLL
cvss3_vuldb_prNNN
cvss3_vuldb_uiRRR
cvss3_vuldb_sUUU
cvss3_vuldb_cNNN
cvss3_vuldb_iLLL
cvss3_vuldb_aNNN
cvss3_vuldb_ePPP
cvss3_vuldb_rcRRR
advisory_urlhttps://github.com/bevennyamande/bloodbank_delete_csrf_attackhttps://github.com/bevennyamande/bloodbank_delete_csrf_attackhttps://github.com/bevennyamande/bloodbank_delete_csrf_attack
exploit_availability111
exploit_publicity111
exploit_urlhttps://github.com/bevennyamande/bloodbank_delete_csrf_attackhttps://github.com/bevennyamande/bloodbank_delete_csrf_attackhttps://github.com/bevennyamande/bloodbank_delete_csrf_attack
source_cveCVE-2024-10448CVE-2024-10448CVE-2024-10448
cna_responsibleVulDBVulDBVulDB
decision_summaryOther endpoints might be affected as well.Other endpoints might be affected as well.Other endpoints might be affected as well.
software_typeBanking SoftwareBanking SoftwareBanking Software
cvss2_vuldb_avNNN
cvss2_vuldb_acLLL
cvss2_vuldb_auNNN
cvss2_vuldb_ciNNN
cvss2_vuldb_iiPPP
cvss2_vuldb_aiNNN
cvss2_vuldb_ePOCPOCPOC
cvss2_vuldb_rcURURUR
cvss4_vuldb_avNNN
cvss2_cna_auN
cvss2_cna_ciN
cvss2_cna_iiP
cvss2_cna_aiN
cvss2_cna_basescore5
cve_nvd_summaryA vulnerability, which was classified as problematic, has been found in code-projects Blood Bank Management System 1.0. Affected by this issue is some unknown functionality of the file /file/delete.php. The manipulation of the argument bid leads to cross-site request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Other endpoints might be affected as well.
cve_nvd_summaryesSe ha encontrado una vulnerabilidad clasificada como problemática en code-projects Blood Bank Management System 1.0. Este problema afecta a algunas funciones desconocidas del archivo /file/delete.php. La manipulación del argumento bid conduce a cross-site request forgery. El ataque puede ejecutarse de forma remota. El exploit se ha hecho público y puede utilizarse. También pueden verse afectados otros endpoints.
cvss4_cna_avN
cvss4_cna_acL
cvss4_cna_atN
cvss4_cna_prN
cvss4_cna_uiN
cvss4_cna_vcN
cvss4_cna_viL
cvss4_cna_vaN
cvss4_cna_scN
cvss4_cna_siN
cvss4_cna_saN
cvss4_cna_bscore6.9
cvss3_cna_avN
cvss3_cna_acL
cvss3_cna_prN
cvss3_cna_uiR
cvss3_cna_sU
cvss3_cna_cN
cvss3_cna_iL
cvss3_cna_aN
cvss3_cna_basescore4.3
cvss3_nvd_avN
cvss3_nvd_acL
cvss3_nvd_prN
cvss3_nvd_uiR
cvss3_nvd_sU
cvss3_nvd_cN
cvss3_nvd_iH
cvss3_nvd_aN
cvss3_nvd_basescore6.5
cvss2_cna_avN
cvss2_cna_acL

◂ PrethodnePregledSledeжi ▸

Do you want to use VulDB in your project?

Use the official API to access entries easily!