CVE-2024-10370

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in Codezips Sales Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /addcustind.php. The manipulation of the argument refno leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
Codezips	Sales Management System	1.0
codezips	sales_management_system	1.0

References

https://github.com/ppp-src/CVE/issues/19Exploit, Third Party Advisory
https://vuldb.com/?ctiid.281762Permissions Required, VDB Entry
https://vuldb.com/?id.281762Third Party Advisory, VDB Entry
https://vuldb.com/?submit.430607Third Party Advisory, VDB Entry

Timeline

Published: Oct 25, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-103719.8A vulnerability classified as critical has been found in SourceCodester Payroll Management System 1.0. This affects the function login of th CVE-2024-103723.6A vulnerability classified as problematic was found in chidiwilliams buzz 1.1.0. This vulnerability affects the function download_model of t CVE-2024-103745.4The WP-Members Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpmem_loginout shortcode CVE-2024-103769.8A vulnerability was found in ESAFENET CDG 5. It has been declared as critical. This vulnerability affects the function actionPassOrNotAutoSi CVE-2024-103779.8A vulnerability was found in ESAFENET CDG 5. It has been rated as critical. This issue affects the function actionPassDecryptApplication1 of CVE-2024-103789.8A vulnerability classified as critical has been found in ESAFENET CDG 5. Affected is the function actionViewCDGRenewFile of the file /com/es CVE-2024-103797.5A vulnerability classified as problematic was found in ESAFENET CDG 5. Affected by this vulnerability is the function actionViewDecyptFile o CVE-2024-10386.1The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to DOM-Based Reflected Cross-Site Scripting via a 'playground CVE-2024-103807.5A vulnerability, which was classified as critical, has been found in SourceCodester Petrol Pump Management Software 1.0. Affected by this is CVE-2024-103819.8This vulnerability exists in Matrix Door Controller Cosec Vega FAXQ due to improper implementation of session management at the web-based ma CVE-2024-103827.5There exists a code execution vulnerability in the Car App Android Jetpack Library. CarAppService uses deserialization logic that allows con CVE-2024-103836.1An issue has been discovered in the gitlab-web-ide-vscode-fork component distributed over CDN affecting all versions prior to 1.89.1-1.0.0-d