CVE-2024-7374

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability classified as critical was found in SourceCodester Simple Realtime Quiz System 1.0. This vulnerability affects unknown code of the file /manage_user.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-273358 is the identifier assigned to this vulnerability.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
SourceCodester	Simple Realtime Quiz System	1.0
sourcecodester	simple_realtime_quiz_system	1.0

References

https://gist.github.com/topsky979/94ae61ff3fc760ac985dcd5e64da06c4Exploit
https://vuldb.com/?ctiid.273358Permissions Required, Third Party Advisory
https://vuldb.com/?id.273358Third Party Advisory
https://vuldb.com/?submit.383522Third Party Advisory

Timeline

Published: Aug 2, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-73759.8A vulnerability, which was classified as critical, has been found in SourceCodester Simple Realtime Quiz System 1.0. This issue affects some CVE-2024-73769.8A vulnerability, which was classified as critical, was found in SourceCodester Simple Realtime Quiz System 1.0. Affected is an unknown funct CVE-2024-73779.8A vulnerability has been found in SourceCodester Simple Realtime Quiz System 1.0 and classified as critical. Affected by this vulnerability CVE-2024-73789.8A vulnerability was found in SourceCodester Simple Realtime Quiz System 1.0 and classified as critical. Affected by this issue is some unkno CVE-2024-73804.3The Geo Controller plugin for WordPress is vulnerable to unauthorized menu creation/deletion due to missing capability checks on the ajax__g CVE-2024-73815.3The Geo Controller plugin for WordPress is vulnerable to unauthorized shortcode execution due to missing authorization and capability checks CVE-2024-73825.3The Linkify Text plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.9.1. This is due to the CVE-2024-73837.4A flaw was found in libnbd. The client did not always correctly verify the NBD server's certificate when using TLS to connect to an NBD serv CVE-2024-73848.8The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to arbitra CVE-2024-73857.2The WordPress Simple HTML Sitemap plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and incl CVE-2024-73864.3The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to CVE-2024-73879.1A flaw was found in openshift/builder. This vulnerability allows command injection via path traversal, where a malicious user can execute ar