CVE-2024-10021

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in code-projects Pharmacy Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /php/manage_purchase.php?action=search&tag=VOUCHER_NUMBER. The manipulation of the argument text leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
code-projects	Pharmacy Management System	1.0
code-projects	pharmacy_management_system	1.0

References

https://code-projects.org/Product
https://gist.github.com/higordiego/439f2af836c2c7d6075ba9de2e1169daExploit, Third Party Advisory
https://vuldb.com/?ctiid.280556Permissions Required, Third Party Advisory, VDB Entry
https://vuldb.com/?id.280556Third Party Advisory, VDB Entry
https://vuldb.com/?submit.424334Third Party Advisory, VDB Entry

Timeline

Published: Oct 16, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-100229.8A vulnerability classified as critical has been found in code-projects Pharmacy Management System 1.0. This affects an unknown part of the f CVE-2024-100238.8A vulnerability classified as critical was found in code-projects Pharmacy Management System 1.0. This vulnerability affects unknown code of CVE-2024-100248.8A vulnerability, which was classified as critical, has been found in code-projects Pharmacy Management System 1.0. This issue affects some u CVE-2024-100259.1A vulnerability in the .sdd file allows an attacker to read default passwords stored in plain text within the code. By exploiting these plai CVE-2024-100265.3A weak hashing algorithm and small sizes of seeds/secrets in Google's gVisor allowed for a remote attacker to calculate a local IP address a CVE-2024-100274.8The WP Booking Calendar WordPress plugin before 10.6.3 does not sanitise and escape some of its Widgets settings, which could allow high pri CVE-2024-100287.5The Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin plugin for WordPress is vulnerable to Sensitive Information CVE-2024-100296.1In Eclipse GlassFish version 7.0.15 is possible to perform Reflected Cross-site scripting attacks in the Administration Console.CVE-2024-10038.8A vulnerability, which was classified as critical, has been found in Totolink N200RE 9.3.5u.6139_B20201216. Affected by this issue is the fu CVE-2024-100315.4In Eclipse GlassFish version 7.0.15 is possible to perform Stored Cross-site Scripting attacks by modifying the configuration file in the un CVE-2024-100325.4In Eclipse GlassFish version 7.0.15 is possible to perform Stored Cross-site scripting attacks in the Administration Console.CVE-2024-100336.1A vulnerability was found in aap-gateway. A Cross-site Scripting (XSS) vulnerability exists in the gateway component. This flaw allows a mal