CVE-2024-13067

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

A vulnerability was found in CodeAstro Online Food Ordering System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/all_users.php of the component All Users Page. The manipulation leads to improper access controls. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-266 CWE-284

Affected software

Vendor	Product	Versions
CodeAstro	Online Food Ordering System	1.0

References

https://codeastro.com/Product
https://github.com/shaturo1337/POCs/blob/main/Broken%20Access%20Control%20in%20Online%20Food%20Ordering%20System.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.289823Permissions Required, VDB Entry
https://vuldb.com/?id.289823Third Party Advisory, VDB Entry
https://vuldb.com/?submit.472081Third Party Advisory, VDB Entry
https://github.com/shaturo1337/POCs/blob/main/Broken%20Access%20Control%20in%20Online%20Food%20Ordering%20System.mdExploit, Third Party Advisory

Timeline

Published: Dec 31, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-130687.3Origin Validation Error vulnerability in Akinsoft LimonDesk allows Forceful Browsing. This issue affects LimonDesk: from s1.02.14 before v1 CVE-2024-130695.4A vulnerability was found in SourceCodester Multi Role Login System 1.0. It has been classified as problematic. Affected is an unknown funct CVE-2024-13076.5The Smart Forms WordPress plugin before 2.6.94 does not have proper authorization in some actions, which could allow users with a role as l CVE-2024-130708.8A vulnerability was found in CodeAstro Online Food Ordering System 1.0. It has been declared as critical. Affected by this vulnerability is CVE-2024-130714.3Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Akinsoft e-Mutabakat allows Cro CVE-2024-130729.8A vulnerability was found in 1000 Projects Beauty Parlour Management System 1.0. It has been rated as critical. Affected by this issue is so CVE-2024-130734.7Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Akinsoft TaskPano allows Cross-CVE-2024-130745.4A vulnerability classified as problematic has been found in PHPGurukul Land Record System 1.0. This affects an unknown part of the file /ind CVE-2024-130755.4A vulnerability classified as problematic was found in PHPGurukul Land Record System 1.0. This vulnerability affects unknown code of the fil CVE-2024-130765.4A vulnerability, which was classified as problematic, has been found in PHPGurukul Land Record System 1.0. This issue affects some unknown p CVE-2024-130775.4A vulnerability, which was classified as problematic, was found in PHPGurukul Land Record System 1.0. Affected is an unknown function of the CVE-2024-130788.8A vulnerability has been found in PHPGurukul Land Record System 1.0 and classified as critical. Affected by this vulnerability is an unknown