{"id":"CVE-2024-5635","state":"PUBLISHED","title":"itsourcecode Bakery Online Ordering System index.php sql injection","description":"A vulnerability was found in itsourcecode Bakery Online Ordering System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file index.php. The manipulation of the argument txtsearch leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-267091.","publishedAt":"2024-06-04T22:00:04.218Z","updatedAt":"2024-08-01T21:18:06.678Z","severity":{"score":5.3,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","source":"VulDB"},"assigner":"VulDB","products":["itsourcecode Bakery Online Ordering System"],"affected":[{"vendor":"itsourcecode","product":"Bakery Online Ordering System","versions":[{"version":"1.0","status":"affected"}]}],"references":["https://vuldb.com/?id.267091","https://vuldb.com/?ctiid.267091","https://vuldb.com/?submit.349244","https://github.com/L1OudFd8cl09/CVE/blob/main/03_06_2024_a.md"],"weaknesses":["CWE-89"],"ingestedAt":"2026-10-29T20:08:12.933Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/5xxx/CVE-2024-5635.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-5635","state":"PUBLISHED","datePublished":"2024-06-04T22:00:04.218Z","dateUpdated":"2024-08-01T21:18:06.678Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2024-06-04T15:21:13.005Z"},"containers":{"cna":{"title":"itsourcecode Bakery Online Ordering System index.php sql injection","descriptions":[{"lang":"en","value":"A vulnerability was found in itsourcecode Bakery Online Ordering System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file index.php. The manipulation of the argument txtsearch leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-267091."},{"lang":"de","value":"In itsourcecode Bakery Online Ordering System 1.0 wurde eine kritische Schwachstelle ausgemacht. Das betrifft eine unbekannte Funktionalität der Datei index.php. Dank der Manipulation des Arguments txtsearch mit unbekannten Daten kann eine sql injection-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk angegangen werden. Der Exploit steht zur öffentlichen Verfügung."}],"affected":[{"vendor":"itsourcecode","product":"Bakery Online Ordering System","versions":[{"version":"1.0","status":"affected"}]}],"references":[{"url":"https://vuldb.com/?id.267091","name":"VDB-267091 | itsourcecode Bakery Online Ordering System index.php sql injection","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.267091","name":"VDB-267091 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.349244","name":"Submit #349244 | itsourceCode Bakery Online Ordering System Using PHP and MySQL Database V1.0 SQL Injection","tags":["third-party-advisory"]},{"url":"https://github.com/L1OudFd8cl09/CVE/blob/main/03_06_2024_a.md","tags":["exploit"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":6.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseSeverity":"MEDIUM"}},{"cvssV3_0":{"version":"3.0","baseScore":6.3,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseSeverity":"MEDIUM"}},{"cvssV2_0":{"version":"2.0","baseScore":6.5,"vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-89","type":"CWE","lang":"en","description":"CWE-89 SQL Injection"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2024-06-04T22:00:04.218Z"},"timeline":[{"time":"2024-06-04T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2024-06-04T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2024-06-04T17:26:22.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"N3xu5Cr4ck37 (VulDB User)","type":"reporter"}]},"adp":[{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"itsourcecode","product":"bakery_online_ordering_system","defaultStatus":"unknown","versions":[{"version":"1.0","status":"affected"}],"cpes":["cpe:2.3:a:itsourcecode:bakery_online_ordering_system:1.0:*:*:*:*:*:*:*"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-07-17T19:51:07.991332Z","id":"CVE-2024-5635","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-07-17T19:53:31.781Z"}},{"title":"CVE Program Container","references":[{"url":"https://vuldb.com/?id.267091","name":"VDB-267091 | itsourcecode Bakery Online Ordering System index.php sql injection","tags":["vdb-entry","technical-description","x_transferred"]},{"url":"https://vuldb.com/?ctiid.267091","name":"VDB-267091 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required","x_transferred"]},{"url":"https://vuldb.com/?submit.349244","name":"Submit #349244 | itsourceCode Bakery Online Ordering System Using PHP and MySQL Database V1.0 SQL Injection","tags":["third-party-advisory","x_transferred"]},{"url":"https://github.com/L1OudFd8cl09/CVE/blob/main/03_06_2024_a.md","tags":["exploit","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-01T21:18:06.678Z"}}]}}}