CVE-2024-5775

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in SourceCodester Vehicle Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file updatebill.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-267458 is the identifier assigned to this vulnerability.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
SourceCodester	Vehicle Management System	1.0
sourcecodester	vehicle_service_management_system	1.0

References

https://github.com/CveSecLook/cve/issues/44Exploit, Issue Tracking
https://vuldb.com/?ctiid.267458Permissions Required, VDB Entry
https://vuldb.com/?id.267458Third Party Advisory, VDB Entry
https://vuldb.com/?submit.352338Third Party Advisory, VDB Entry
https://github.com/CveSecLook/cve/issues/44Exploit, Issue Tracking
https://vuldb.com/?ctiid.267458Permissions Required, VDB Entry
https://vuldb.com/?id.267458Third Party Advisory, VDB Entry
https://vuldb.com/?submit.352338Third Party Advisory, VDB Entry

Timeline

Published: Jun 9, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-577577.5JeeWMS before v2025.01.01 was discovered to contain a permission bypass in the component /interceptors/AuthInterceptor.cava.CVE-2024-577606.5JeeWMS before v2025.01.01 was discovered to contain a SQL injection vulnerability via the ReportId parameter at /core/CGReportDao.java.CVE-2024-577618.1An arbitrary file upload vulnerability in the parserXML() method of JeeWMS before v2025.01.01 allows attackers to execute arbitrary code via CVE-2024-577627.5MSFM before v2025.01.01 was discovered to contain a deserialization vulnerability via the pom.xml configuration file.CVE-2024-577639.1MSFM before 2025.01.01 was discovered to contain a fastjson deserialization vulnerability via the component system/table/addField.CVE-2024-577649.1MSFM before 2025.01.01 was discovered to contain a fastjson deserialization vulnerability via the component system/table/add.CVE-2024-577657.5MSFM before 2025.01.01 was discovered to contain a SQL injection vulnerability via the s_name parameter at table/list.CVE-2024-577669.1MSFM before 2025.01.01 was discovered to contain a fastjson deserialization vulnerability via the component system/table/editField.CVE-2024-577678.6MSFM before v2025.01.01 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /file/download.CVE-2024-577689.8JFinalOA before v2025.01.01 was discovered to contain a SQL injection vulnerability via the component validRoleKey?sysRole.key.CVE-2024-577698.8JFinalOA before v2025.01.01 was discovered to contain a SQL injection vulnerability via the component borrowmoney/listData?applyUser.CVE-2024-577708.8JFinalOA before v2025.01.01 was discovered to contain a SQL injection vulnerability via the component apply/save#oaContractApply.id.