CVE-2024-7199

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability classified as critical was found in SourceCodester Complaints Report Management System 1.0. This vulnerability affects unknown code of the file /admin/manage_user.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-272620.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
SourceCodester	Complaints Report Management System	1.0
sourcecodester	complaints_report_management_system	1.0

References

https://gist.github.com/topsky979/75ba3db98584b13d65d874e4fcac154bExploit
https://vuldb.com/?ctiid.272620Permissions Required, Third Party Advisory
https://vuldb.com/?id.272620Permissions Required, Third Party Advisory
https://vuldb.com/?submit.380421Third Party Advisory
https://gist.github.com/topsky979/75ba3db98584b13d65d874e4fcac154bExploit
https://vuldb.com/?ctiid.272620Permissions Required, Third Party Advisory
https://vuldb.com/?id.272620Permissions Required, Third Party Advisory
https://vuldb.com/?submit.380421Third Party Advisory

Timeline

Published: Jul 29, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-72005.4A vulnerability, which was classified as problematic, has been found in SourceCodester Complaints Report Management System 1.0. This issue a CVE-2024-72019.8The login functionality of WinMatrix3 Web package from Simopro Technology lacks proper validation of user input, allowing unauthenticated re CVE-2024-72029.8The query functionality of WinMatrix3 Web package from Simopro Technology lacks proper validation of user input, allowing unauthenticated re CVE-2024-72037.2A post-authentication command injection vulnerability in Zyxel ATP series firmware versions from V4.60 through V5.38 and USG FLEX series fir CVE-2024-72046.1Ai3 QbiBot does not properly filter user input, allowing unauthenticated remote attackers to insert JavaScript code into the chat box. Once CVE-2024-72059.4When the device is shared, the homepage module are before 2.19.0 in eWeLink Cloud Service allows Secondary user to take over devices as pri CVE-2024-72067.0SSL Pinning Bypass in eWeLink Some hardware products allows local ATTACKER to Decrypt TLS communication and Extract secrets to clone the dev CVE-2024-72086.5A vulnerability in multi-tenant hosting allows an authenticated sender to spoof the identity of a shared, hosted domain, thus bypass securit CVE-2024-72096.5A vulnerability exists in the use of shared SPF records in multi-tenant hosting providers, allowing attackers to use network authorization t CVE-2024-72116.1The 1E Platform's component utilized the third-party Duende Identity Server, which suffered from an open redirect vulnerability, permitting CVE-2024-72128.8A vulnerability, which was classified as critical, has been found in TOTOLINK A7000R 9.1.0u.6268_B20220504. This issue affects the function CVE-2024-72138.8A vulnerability, which was classified as critical, was found in TOTOLINK A7000R 9.1.0u.6268_B20220504. Affected is the function setWizardCfg