CVE-2024-6194

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability, which was classified as critical, was found in itsourcecode Tailoring Management System 1.0. Affected is an unknown function of the file editmeasurement.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-269166 is the identifier assigned to this vulnerability.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
itsourcecode	Tailoring Management System	1.0
itsourcecode	tailoring_management_system	1.0

References

https://github.com/HryspaHodor/CVE/issues/6Exploit, Technical Description, Third Party Advisory
https://vuldb.com/?ctiid.269166Permissions Required
https://vuldb.com/?id.269166Third Party Advisory
https://vuldb.com/?submit.359019Issue Tracking
https://github.com/HryspaHodor/CVE/issues/6Exploit, Technical Description, Third Party Advisory
https://vuldb.com/?ctiid.269166Permissions Required
https://vuldb.com/?id.269166Third Party Advisory
https://vuldb.com/?submit.359019Issue Tracking

Timeline

Published: Jun 20, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-61959.8A vulnerability has been found in itsourcecode Tailoring Management System 1.0 and classified as critical. Affected by this vulnerability is CVE-2024-61969.8A vulnerability was found in itsourcecode Banking Management System 1.0 and classified as critical. Affected by this issue is some unknown f CVE-2024-61977.5libcurl's ASN1 parser has this utf8asn1str() function used for parsing an ASN.1 UTF-8 string. Itcan detect an invalid field and return error CVE-2024-61987.7The device exposes a web interface on ports TCP/3030 and TCP/9882. This web service runs lighttpd, which implements the “SNORE” interface. T CVE-2024-61997.7An unauthenticated attacker on the WAN interface, with the ability to intercept Dynamic DNS (DDNS) traffic between DDNS services and the mod CVE-2024-62005.4HaloITSM versions up to 2.146.1 are affected by a Stored Cross-Site Scripting (XSS) vulnerability. The injected JavaScript code can execute CVE-2024-62015.3HaloITSM versions up to 2.146.1 are affected by a Template Injection vulnerability within the engine used to generate emails. This can lead CVE-2024-62029.8HaloITSM versions up to 2.146.1 are affected by a SAML XML Signature Wrapping (XSW) vulnerability. When having a SAML integration configured CVE-2024-62038.1HaloITSM versions up to 2.146.1 are affected by a Password Reset Poisoning vulnerability. Poisoned password reset links can be sent to exist CVE-2024-62048.1Zohocorp ManageEngine Exchange Reporter Plus versions before 5715 are vulnerable to SQL Injection in the reports module.CVE-2024-62059.8The PayPlus Payment Gateway WordPress plugin before 6.6.9 does not properly sanitise and escape a parameter before using it in a SQL stateme CVE-2024-62067.5A security vulnerability has been identified in HPE Athonet Mobile Core software. The core application contains a code injection vulnerabili