CVE-2024-6193

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability, which was classified as critical, has been found in itsourcecode Vehicle Management System 1.0. This issue affects some unknown processing of the file driverprofile.php. The manipulation of the argument driverid leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-269165 was assigned to this vulnerability.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
itsourcecode	Vehicle Management System	1.0
itsourcecode	vehicle_management_system	1.0

References

https://github.com/HryspaHodor/CVE/issues/5Exploit, Technical Description, Third Party Advisory
https://vuldb.com/?ctiid.269165Permissions Required
https://vuldb.com/?id.269165Third Party Advisory
https://vuldb.com/?submit.359018Issue Tracking
https://github.com/HryspaHodor/CVE/issues/5Exploit, Technical Description, Third Party Advisory
https://vuldb.com/?ctiid.269165Permissions Required
https://vuldb.com/?id.269165Third Party Advisory
https://vuldb.com/?submit.359018Issue Tracking

Timeline

Published: Jun 20, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-61949.8A vulnerability, which was classified as critical, was found in itsourcecode Tailoring Management System 1.0. Affected is an unknown functio CVE-2024-61959.8A vulnerability has been found in itsourcecode Tailoring Management System 1.0 and classified as critical. Affected by this vulnerability is CVE-2024-61969.8A vulnerability was found in itsourcecode Banking Management System 1.0 and classified as critical. Affected by this issue is some unknown f CVE-2024-61977.5libcurl's ASN1 parser has this utf8asn1str() function used for parsing an ASN.1 UTF-8 string. Itcan detect an invalid field and return error CVE-2024-61987.7The device exposes a web interface on ports TCP/3030 and TCP/9882. This web service runs lighttpd, which implements the “SNORE” interface. T CVE-2024-61997.7An unauthenticated attacker on the WAN interface, with the ability to intercept Dynamic DNS (DDNS) traffic between DDNS services and the mod CVE-2024-62005.4HaloITSM versions up to 2.146.1 are affected by a Stored Cross-Site Scripting (XSS) vulnerability. The injected JavaScript code can execute CVE-2024-62015.3HaloITSM versions up to 2.146.1 are affected by a Template Injection vulnerability within the engine used to generate emails. This can lead CVE-2024-62029.8HaloITSM versions up to 2.146.1 are affected by a SAML XML Signature Wrapping (XSW) vulnerability. When having a SAML integration configured CVE-2024-62038.1HaloITSM versions up to 2.146.1 are affected by a Password Reset Poisoning vulnerability. Poisoned password reset links can be sent to exist CVE-2024-62048.1Zohocorp ManageEngine Exchange Reporter Plus versions before 5715 are vulnerable to SQL Injection in the reports module.CVE-2024-62059.8The PayPlus Payment Gateway WordPress plugin before 6.6.9 does not properly sanitise and escape a parameter before using it in a SQL stateme