CVE-2024-48245

HighCVSS 7.2/10Last modified Jul 5, 2026

Description

Vehicle Management System 1.0 is vulnerable to SQL Injection. A guest user can exploit vulnerable POST parameters in various administrative actions, such as booking a vehicle or confirming a booking. The affected parameters include "Booking ID", "Action Name", and "Payment Confirmation ID", which are present in /newvehicle.php and /newdriver.php.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Jan 7, 2025
Last modified: Jul 5, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-482465.4Vehicle Management System 1.0 contains a Stored Cross-Site Scripting (XSS) vulnerability in the "Name" parameter of /vehicle-management/book CVE-2024-482488.6NAKIVO Backup & Replication before 11.0.0.88174 allows absolute path traversal for reading files via getImageByPath to /c/router (this may l CVE-2024-482497.3Wavelog 1.8.5 allows Gridmap_model.php get_band_confirmed SQL injection via band, sat, propagation, or mode.CVE-2024-48259.8A vulnerability has been discovered in Agentejo Cockpit CMS v0.5.5 that consists in an arbitrary file upload in ‘/media/api’ parameter via p CVE-2024-482519.8Wavelog 1.8.5 allows Activated_gridmap_model.php get_band_confirmed SQL injection via band, sat, propagation, or mode.CVE-2024-482539.8Cloudlog 2.6.15 allows Oqrs.php delete_oqrs_line id SQL injection.CVE-2024-482559.8Cloudlog 2.6.15 allows Oqrs.php get_station_info station_id SQL injection.CVE-2024-482579.8Wavelog 1.8.5 allows Oqrs_model.php get_worked_modes station_id SQL injectioin.CVE-2024-482597.3Cloudlog 2.6.15 allows Oqrs.php request_form SQL injection via station_id or callsign.CVE-2024-48269.8SQL injection vulnerability in Simple PHP Shopping Cart affecting version 0.9. This vulnerability could allow an attacker to retrieve all th CVE-2024-482707.5An issue in the component /logins of oasys v1.1 allows attackers to access sensitive information via a burst attack.CVE-2024-482718.8D-Link DSL6740C v6.TR069.20211230 was discovered to use insecure default credentials for Administrator access, possibly allowing attackers t