CVE-2024-13070

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in CodeAstro Online Food Ordering System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/update_users.php of the component Update User Page. The manipulation of the argument user_upd leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
CodeAstro	Online Food Ordering System	1.0

References

https://codeastro.com/Product
https://github.com/shaturo1337/POCs/blob/main/RCE%20via%20SQL%20Injection%20in%20Online%20Food%20Ordering%20System.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.289825Permissions Required, VDB Entry
https://vuldb.com/?id.289825Third Party Advisory, VDB Entry
https://vuldb.com/?submit.472104Third Party Advisory, VDB Entry
https://github.com/shaturo1337/POCs/blob/main/RCE%20via%20SQL%20Injection%20in%20Online%20Food%20Ordering%20System.mdExploit, Third Party Advisory

Timeline

Published: Dec 31, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-130714.3Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Akinsoft e-Mutabakat allows Cro CVE-2024-130729.8A vulnerability was found in 1000 Projects Beauty Parlour Management System 1.0. It has been rated as critical. Affected by this issue is so CVE-2024-130734.7Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Akinsoft TaskPano allows Cross-CVE-2024-130745.4A vulnerability classified as problematic has been found in PHPGurukul Land Record System 1.0. This affects an unknown part of the file /ind CVE-2024-130755.4A vulnerability classified as problematic was found in PHPGurukul Land Record System 1.0. This vulnerability affects unknown code of the fil CVE-2024-130765.4A vulnerability, which was classified as problematic, has been found in PHPGurukul Land Record System 1.0. This issue affects some unknown p CVE-2024-130775.4A vulnerability, which was classified as problematic, was found in PHPGurukul Land Record System 1.0. Affected is an unknown function of the CVE-2024-130788.8A vulnerability has been found in PHPGurukul Land Record System 1.0 and classified as critical. Affected by this vulnerability is an unknown CVE-2024-130798.8A vulnerability was found in PHPGurukul Land Record System 1.0 and classified as critical. Affected by this issue is some unknown functional CVE-2024-13087.5The WooCommerce Cloak Affiliate Links plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability ch CVE-2024-130805.4A vulnerability was found in PHPGurukul Land Record System 1.0. It has been classified as problematic. This affects an unknown part of the f CVE-2024-130815.4A vulnerability was found in PHPGurukul Land Record System 1.0. It has been declared as problematic. This vulnerability affects unknown code