CVE-2024-6192

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability classified as critical was found in itsourcecode Loan Management System 1.0. This vulnerability affects unknown code of the file login.php of the component Login Page. The manipulation of the argument username leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-269164.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
itsourcecode	Loan Management System	1.0
itsourcecode	loan_management_system	1.0

References

https://github.com/HryspaHodor/CVE/issues/4Exploit, Issue Tracking, Third Party Advisory
https://vuldb.com/?ctiid.269164Permissions Required
https://vuldb.com/?id.269164Third Party Advisory, VDB Entry
https://vuldb.com/?submit.359017Third Party Advisory, VDB Entry
https://github.com/HryspaHodor/CVE/issues/4Exploit, Issue Tracking, Third Party Advisory
https://vuldb.com/?ctiid.269164Permissions Required
https://vuldb.com/?id.269164Third Party Advisory, VDB Entry
https://vuldb.com/?submit.359017Third Party Advisory, VDB Entry

Timeline

Published: Jun 20, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-61939.8A vulnerability, which was classified as critical, has been found in itsourcecode Vehicle Management System 1.0. This issue affects some unk CVE-2024-61949.8A vulnerability, which was classified as critical, was found in itsourcecode Tailoring Management System 1.0. Affected is an unknown functio CVE-2024-61959.8A vulnerability has been found in itsourcecode Tailoring Management System 1.0 and classified as critical. Affected by this vulnerability is CVE-2024-61969.8A vulnerability was found in itsourcecode Banking Management System 1.0 and classified as critical. Affected by this issue is some unknown f CVE-2024-61977.5libcurl's ASN1 parser has this utf8asn1str() function used for parsing an ASN.1 UTF-8 string. Itcan detect an invalid field and return error CVE-2024-61987.7The device exposes a web interface on ports TCP/3030 and TCP/9882. This web service runs lighttpd, which implements the “SNORE” interface. T CVE-2024-61997.7An unauthenticated attacker on the WAN interface, with the ability to intercept Dynamic DNS (DDNS) traffic between DDNS services and the mod CVE-2024-62005.4HaloITSM versions up to 2.146.1 are affected by a Stored Cross-Site Scripting (XSS) vulnerability. The injected JavaScript code can execute CVE-2024-62015.3HaloITSM versions up to 2.146.1 are affected by a Template Injection vulnerability within the engine used to generate emails. This can lead CVE-2024-62029.8HaloITSM versions up to 2.146.1 are affected by a SAML XML Signature Wrapping (XSW) vulnerability. When having a SAML integration configured CVE-2024-62038.1HaloITSM versions up to 2.146.1 are affected by a Password Reset Poisoning vulnerability. Poisoned password reset links can be sent to exist CVE-2024-62048.1Zohocorp ManageEngine Exchange Reporter Plus versions before 5715 are vulnerable to SQL Injection in the reports module.