{"id":"CVE-2024-11632","state":"PUBLISHED","title":"code-projects Simple Car Rental System book_car.php sql injection","description":"A vulnerability was found in code-projects Simple Car Rental System 1.0. It has been classified as critical. Affected is an unknown function of the file /book_car.php. The manipulation of the argument fname/id_no/gender/email/phone/location leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The initial researcher advisory only mentions the parameter \"fname\" to be affected. Further analysis indicates that other arguments might be affected as well.","publishedAt":"2024-11-23T13:31:03.961Z","updatedAt":"2024-11-26T16:11:24.862Z","severity":{"score":6.9,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","source":"VulDB"},"assigner":"VulDB","products":["code-projects Simple Car Rental System"],"affected":[{"vendor":"code-projects","product":"Simple Car Rental System","versions":[{"version":"1.0","status":"affected"}]}],"references":["https://vuldb.com/?id.285918","https://vuldb.com/?ctiid.285918","https://vuldb.com/?submit.446308","https://github.com/sil3n/cve/issues/2","https://code-projects.org/"],"weaknesses":["CWE-89","CWE-74"],"ingestedAt":"2026-10-29T20:06:50.777Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/11xxx/CVE-2024-11632.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-11632","state":"PUBLISHED","datePublished":"2024-11-23T13:31:03.961Z","dateUpdated":"2024-11-26T16:11:24.862Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2024-11-22T17:06:44.093Z"},"containers":{"cna":{"title":"code-projects Simple Car Rental System book_car.php sql injection","descriptions":[{"lang":"en","value":"A vulnerability was found in code-projects Simple Car Rental System 1.0. It has been classified as critical. Affected is an unknown function of the file /book_car.php. The manipulation of the argument fname/id_no/gender/email/phone/location leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The initial researcher advisory only mentions the parameter \"fname\" to be affected. Further analysis indicates that other arguments might be affected as well."},{"lang":"de","value":"Es wurde eine kritische Schwachstelle in code-projects Simple Car Rental System 1.0 ausgemacht. Dabei betrifft es einen unbekannter Codeteil der Datei /book_car.php. Mittels Manipulieren des Arguments fname/id_no/gender/email/phone/location mit unbekannten Daten kann eine sql injection-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs kann dabei über das Netzwerk erfolgen. Der Exploit steht zur öffentlichen Verfügung."}],"affected":[{"vendor":"code-projects","product":"Simple Car Rental System","versions":[{"version":"1.0","status":"affected"}]}],"references":[{"url":"https://vuldb.com/?id.285918","name":"VDB-285918 | code-projects Simple Car Rental System book_car.php sql injection","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.285918","name":"VDB-285918 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.446308","name":"Submit #446308 | code-projects Simple Car Rental System 1.0 SQL Injection","tags":["third-party-advisory"]},{"url":"https://github.com/sil3n/cve/issues/2","tags":["exploit","issue-tracking"]},{"url":"https://code-projects.org/","tags":["product"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":7.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseSeverity":"HIGH"}},{"cvssV3_0":{"version":"3.0","baseScore":7.3,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseSeverity":"HIGH"}},{"cvssV2_0":{"version":"2.0","baseScore":7.5,"vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-89","type":"CWE","lang":"en","description":"SQL Injection"}]},{"descriptions":[{"cweId":"CWE-74","type":"CWE","lang":"en","description":"Injection"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2024-11-23T13:31:03.961Z"},"timeline":[{"time":"2024-11-22T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2024-11-22T01:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2024-11-22T18:11:54.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"silen (VulDB User)","type":"reporter"}]},"adp":[{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"code-projects","product":"simple_car_rental_system","defaultStatus":"unknown","versions":[{"version":"1.0","status":"affected"}],"cpes":["cpe:2.3:a:code-projects:simple_car_rental_system:1.0:*:*:*:*:*:*:*"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-11-26T16:10:49.598714Z","id":"CVE-2024-11632","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-11-26T16:11:24.862Z"}}]}}}