CVE-2024-9293

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability classified as critical was found in skyselang yylAdmin up to 3.0. Affected by this vulnerability is the function list of the file /app/admin/controller/file/File.php of the component Backend. The manipulation of the argument is_disable leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
skyselang	yylAdmin	3.0
yyladmin_project	yyladmin	3.0

References

https://gitee.com/A0kooo/cve_article/blob/master/yyladmin/yyladmin%20file%20list%20have%20SQL%20injection.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.278785Permissions Required, Third Party Advisory, VDB Entry
https://vuldb.com/?id.278785Third Party Advisory, VDB Entry
https://vuldb.com/?submit.411499Third Party Advisory, VDB Entry

Timeline

Published: Sep 27, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-92946.3A vulnerability, which was classified as critical, has been found in dingfanzu CMS up to 29d67d9044f6f93378e6eb6ff92272217ff7225c. Affected CVE-2024-92959.8A vulnerability was found in SourceCodester Advocate Office Management System 1.0 and classified as critical. This issue affects some unknow CVE-2024-92969.8A vulnerability was found in SourceCodester Advocate Office Management System 1.0. It has been classified as critical. Affected is an unknow CVE-2024-92976.3A vulnerability was found in SourceCodester Online Railway Reservation System 1.0. It has been declared as critical. Affected by this vulner CVE-2024-92984.3A vulnerability was found in SourceCodester Online Railway Reservation System 1.0. It has been rated as problematic. Affected by this issue CVE-2024-92995.4A vulnerability classified as problematic has been found in SourceCodester Online Railway Reservation System 1.0. This affects an unknown pa CVE-2024-93006.1A vulnerability classified as problematic was found in SourceCodester Online Railway Reservation System 1.0. This vulnerability affects unkn CVE-2024-93017.5A path traversal issue in E2Nest prior to commit 8a41948e553c89c56b14410c6ed395e9cfb9250a CVE-2024-93029.8The App Builder – Create Native Android & iOS Apps On The Flight plugin for WordPress is vulnerable to privilege escalation via account take CVE-2024-93046.4The LocateAndFilter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and includ CVE-2024-93059.8The AppPresser – Mobile App Framework plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to,CVE-2024-93064.8The WP Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and incl