CVE-2024-37872

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

SQL injection vulnerability in process.php in Itsourcecode Billing System in PHP 1.0 allows remote attackers to execute arbitrary SQL commands via the username parameter.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a
itsourcecode	billing_system	1.0

References

https://github.com/TThuyyy/cve1/issues/4Exploit, Issue Tracking, Third Party Advisory
https://github.com/TThuyyy/cve1/issues/4Exploit, Issue Tracking, Third Party Advisory

Timeline

Published: Jul 9, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-378739.8SQL injection vulnerability in view_payslip.php in Itsourcecode Payroll Management System Project In PHP With Source Code 1.0 allows remote CVE-2024-378775.5UERANSIM before 3.2.6 allows out-of-bounds read when a RLS packet is sent to gNodeB with malformed PDU length. This occurs in function readO CVE-2024-378786.1Cross Site Scripting vulnerability in TWCMS v.2.0.3 allows a remote attacker to execute arbitrary code via the /TWCMS-gh-pages/twcms/runtime CVE-2024-378794.8Improper input validation in /admin/config/save in User-friendly SVN (USVN) before v1.0.12 and below allows administrators to execute arbitr CVE-2024-37886.6Vulnerability in WBSAirback 21.02.04, which involves improper neutralisation of Server-Side Includes (SSI), through License (/admin/CDPUsers CVE-2024-378807.5The Kyber reference implementation before 9b8d306, when compiled by LLVM Clang through 18.x with some common optimization options, has a tim CVE-2024-378815.3SiteGuard WP Plugin provides a functionality to customize the path to the login page wp-login.php and implements a measure to avoid redirect CVE-2024-378828.1Nextcloud Server is a self hosted personal cloud system. A recipient of a share with read&share permissions could reshare the item with more CVE-2024-378834.3Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. CVE-2024-378845.4Nextcloud Server is a self hosted personal cloud system. A malicious user was able to send delete requests for old versions of files they on CVE-2024-378857.8The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with your computer. A code injection in Nextcloud Desktop CVE-2024-378864.7user_oidc app is an OpenID Connect user backend for Nextcloud. An attacker could potentially trick the app into accepting a request that is