CVE-2024-5636

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in itsourcecode Bakery Online Ordering System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file report/index.php. The manipulation of the argument procduct leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-267092.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
itsourcecode	Bakery Online Ordering System	1.0

References

https://github.com/L1OudFd8cl09/CVE/blob/main/03_06_2024_b.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.267092Permissions Required, VDB Entry
https://vuldb.com/?id.267092Third Party Advisory, VDB Entry
https://vuldb.com/?submit.349247Third Party Advisory, VDB Entry
https://github.com/L1OudFd8cl09/CVE/blob/main/03_06_2024_b.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.267092Permissions Required, VDB Entry
https://vuldb.com/?id.267092Third Party Advisory, VDB Entry
https://vuldb.com/?submit.349247Third Party Advisory, VDB Entry

Timeline

Published: Jun 5, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-563615.3LGSL (Live Game Server List) provides online status for games. Before 7.0.0, a stored cross-site scripting (XSS) vulnerability was identifie CVE-2024-563625.5Navidrome is an open source web-based music collection server and streamer. Navidrome stores the JWT secret in plaintext in the navidrome.db CVE-2024-563637.8APTRS (Automated Penetration Testing Reporting System) is a Python and Django-based automated reporting tool designed for penetration tester CVE-2024-563645.4SimpleXLSX is software for parsing and retrieving data from Excel XLSx files. Starting in 1.0.12 and ending in 1.1.13, when calling the exte CVE-2024-563655.4PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 are vulnerable CVE-2024-563665.4PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 are vulnerable CVE-2024-563685.5In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix overflow in __rb_map_vma An overflow occurred when pe CVE-2024-563695.5In the Linux kernel, the following vulnerability has been resolved: drm/modes: Avoid divide by zero harder in drm_mode_vrefresh() drm_mode CVE-2024-56378.1The Market Exporter plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'remove_files' CVE-2024-563706.5Net::Xero 0.044 and earlier for Perl uses the rand() function as the default source of entropy, which is not cryptographically secure, for c CVE-2024-563725.5In the Linux kernel, the following vulnerability has been resolved: net: tun: fix tun_napi_alloc_frags() syzbot reported the following cra CVE-2024-563738.4DAG Author (who already has quite a lot of permissions) could manipulate database of Airflow 2 in the way to execute arbitrary code in the w