CVE-2024-11487

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability has been found in Code4Berry Decoration Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /decoration/admin/btndates_report.php of the component Between Dates Reports. The manipulation of the argument fromdate/todate leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
Code4Berry	Decoration Management System	1.0

References

https://vuldb.com/?ctiid.285502Permissions Required
https://vuldb.com/?id.285502Third Party Advisory, VDB Entry
https://vuldb.com/?submit.441917Third Party Advisory

Timeline

Published: Nov 20, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-114886.1A vulnerability was found in 115cms up to 20240807 and classified as problematic. This issue affects some unknown processing of the file /ap CVE-2024-114896.1A vulnerability was found in 115cms up to 20240807. It has been classified as problematic. Affected is an unknown function of the file /inde CVE-2024-11495.5Improper Verification of Cryptographic Signature vulnerability in Snow Software Inventory Agent on MacOS, Snow Software Inventory Agent on W CVE-2024-114906.1A vulnerability was found in 115cms up to 20240807. It has been declared as problematic. Affected by this vulnerability is an unknown functi CVE-2024-114915.4A vulnerability was found in 115cms up to 20240807. It has been rated as problematic. Affected by this issue is some unknown functionality o CVE-2024-114926.1A vulnerability classified as problematic has been found in 115cms up to 20240807. This affects an unknown part of the file /index.php/admin CVE-2024-114936.1A vulnerability classified as problematic was found in 115cms up to 20240807. This vulnerability affects unknown code of the file /index.php CVE-2024-114947.5**UNSUPPORTED WHEN ASSIGNED** The improper authentication vulnerability in the Zyxel P-6101C ADSL modem firmware version P-6101CSA6AP_201403 CVE-2024-114957.8Buffer overflow vulnerability in OllyDbg, version 1.10, which could allow a local attacker to execute arbitrary code due to lack of proper b CVE-2024-114966.5The Infility Global plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the infilit CVE-2024-114978.8An authenticated attacker can use this vulnerability to perform a privilege escalation to gain root access.CVE-2024-114987.5There exists a stack buffer overflow in libjxl. A specifically-crafted file can cause the JPEG XL decoder to use large amounts of stack spac