{"id":"CVE-2024-7851","state":"PUBLISHED","title":"SourceCodester Yoga Class Registration System Add User Users.php improper authorization","description":"A vulnerability has been found in SourceCodester Yoga Class Registration System 1.0 and classified as critical. This vulnerability affects unknown code of the file /classes/Users.php?f=save of the component Add User Handler. The manipulation leads to improper authorization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.","publishedAt":"2024-08-16T00:00:05.504Z","updatedAt":"2024-09-03T18:00:41.196Z","severity":{"score":5.3,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","source":"VulDB"},"assigner":"VulDB","products":["SourceCodester Yoga Class Registration System"],"affected":[{"vendor":"SourceCodester","product":"Yoga Class Registration System","versions":[{"version":"1.0","status":"affected"}],"modules":["Add User Handler"]}],"references":["https://vuldb.com/?id.274756","https://vuldb.com/?ctiid.274756","https://vuldb.com/?submit.391640","https://github.com/Wsstiger/cve/blob/main/Yoga_add.md"],"weaknesses":["CWE-285"],"ingestedAt":"2026-10-29T20:08:20.985Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/7xxx/CVE-2024-7851.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-7851","state":"PUBLISHED","datePublished":"2024-08-16T00:00:05.504Z","dateUpdated":"2024-09-03T18:00:41.196Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2024-08-15T16:06:37.817Z"},"containers":{"cna":{"title":"SourceCodester Yoga Class Registration System Add User Users.php improper authorization","descriptions":[{"lang":"en","value":"A vulnerability has been found in SourceCodester Yoga Class Registration System 1.0 and classified as critical. This vulnerability affects unknown code of the file /classes/Users.php?f=save of the component Add User Handler. The manipulation leads to improper authorization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used."},{"lang":"de","value":"In SourceCodester Yoga Class Registration System 1.0 wurde eine kritische Schwachstelle gefunden. Das betrifft eine unbekannte Funktionalität der Datei /classes/Users.php?f=save der Komponente Add User Handler. Durch das Beeinflussen mit unbekannten Daten kann eine improper authorization-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk angegangen werden. Der Exploit steht zur öffentlichen Verfügung."}],"affected":[{"vendor":"SourceCodester","product":"Yoga Class Registration System","versions":[{"version":"1.0","status":"affected"}],"modules":["Add User Handler"]}],"references":[{"url":"https://vuldb.com/?id.274756","name":"VDB-274756 | SourceCodester Yoga Class Registration System Add User Users.php improper authorization","tags":["vdb-entry"]},{"url":"https://vuldb.com/?ctiid.274756","name":"VDB-274756 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.391640","name":"Submit #391640 | sourcecodester Yoga Class Registration System v1.0 Add by any user","tags":["third-party-advisory"]},{"url":"https://github.com/Wsstiger/cve/blob/main/Yoga_add.md","tags":["exploit"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":6.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseSeverity":"MEDIUM"}},{"cvssV3_0":{"version":"3.0","baseScore":6.3,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseSeverity":"MEDIUM"}},{"cvssV2_0":{"version":"2.0","baseScore":6.5,"vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-285","type":"CWE","lang":"en","description":"CWE-285 Improper Authorization"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2024-08-16T00:00:05.504Z"},"timeline":[{"time":"2024-08-15T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2024-08-15T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2024-08-15T18:11:49.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"Wsstiger (VulDB User)","type":"reporter"}]},"adp":[{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"sourcecodester","product":"yoga_class_registration_system","defaultStatus":"unknown","versions":[{"version":"1.0","status":"affected"}],"cpes":["cpe:2.3:a:sourcecodester:yoga_class_registration_system:*:*:*:*:*:*:*:*"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-08-16T14:04:39.548872Z","id":"CVE-2024-7851","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-09-03T18:00:41.196Z"}}]}}}