Treasury module is vulnerable to cross-contract reentrancy

Lines of code Vulnerability details Impact An attacker can pay back their loan to the treasury module with protocol-owned tokens. This will cause their loan to decrease despite the protocol won't be given funds for it. Proof of Concept The code first measures the number of tokens in the treasury,...

User can get loan without dept

Lines of code Vulnerability details Impact User can get loan without permission and dept Proof of Concept TRSRY.withdrawReserves does same validation with TRSRY.getLoan and TRSRY.withdrawReserves does not have permissioned modifier, so anyone can get loan from Treasury without any permission and...

interest rate calculate vulnerability

Lines of code Vulnerability details Impact function addinterst uses the interest rate immediately generated by the current block first transaction calculated,it will cause some interest lose. Proof of Concepmt function addinterst uses the interest rate immediately generated by the current block t...

Attackers can abuse the quitLock function to get a very large amount of votes

Lines of code Vulnerability details Impact An attacker can use a flashloan and the quitLock function to achieve a large amount of votes for one transaction. It can, depends on the implementation of the modules that will use this contract, be used to pass malicious proposals or exploit any feature...

CVE-2022-2766

A vulnerability was found in SourceCodester Loan Management System. It has been rated as critical. Affected by this issue is some unknown functionality of the file /index.php. The manipulation of the argument password leads to sql injection. The attack may be launched remotely. The exploit has be...

Sql injection

A vulnerability was found in SourceCodester Loan Management System. It has been rated as critical. Affected by this issue is some unknown functionality of the file /index.php. The manipulation of the argument password leads to sql injection. The attack may be launched remotely. The exploit has be...

CVE-2022-2766 SourceCodester Loan Management System index.php sql injection

A vulnerability was found in SourceCodester Loan Management System. It has been rated as critical. Affected by this issue is some unknown functionality of the file /index.php. The manipulation of the argument password leads to sql injection. The attack may be launched remotely. The exploit has be...

CVE-2022-2766

CVE-2022-2766 affects the SourceCodester Loan Management System. Affected component: unknown functionality in the file /index.php ; vulnerability arises from manipulating the password parameter, causing a SQL injection . Exploitation can be remote and the exploit has been publicly disclosed (VDB-...

CVE-2022-2766 SourceCodester Loan Management System index.php sql injection

A vulnerability was found in SourceCodester Loan Management System. It has been rated as critical. Affected by this issue is some unknown functionality of the file /index.php. The manipulation of the argument password leads to sql injection. The attack may be launched remotely. The exploit has be...

Loan Management System SQL注入漏洞

Loan Management System is a loan management system by razormist individual developers. Loan Management System suffers from a SQL injection vulnerability that stems from some unknown functionality in the file /index.php being affected, where manipulation of the parameter password can lead to sql...

PT-2022-18556 · Sourcecodester · Sourcecodester Loan Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Loan Management System affected versions not specified Description: A critical issue affects some unknown functionality of the file /index.php. The manipulation of the password argument leads to SQL injection. The attack can be...

Manager is able to charge an excessive fee by taking out a larger than necessary flash loan

Lines of code Vulnerability details Impact The manager's fee is determined by the flash loan amount he takes out. A manager can take out a large flash loan to increase the fee due to him. Proof of Concept Manager needs to rebalance a vault. Manager only needs 50k flash loan. Manager takes out 2m...

Ownership transfer not correctly handled for flash loans

Lines of code Vulnerability details Impact In response to a flashloan, proxyRegistry.getCurrentProxyowner is used to retrieve the correct user proxy and check that this proxy has initiated the flash loan. This can be problematic after ownership transfers of the proxy, where...

CVE-2022-2667

A vulnerability was found in SourceCodester Loan Management System and classified as critical. This issue affects some unknown processing of the file deletelplan.php. The manipulation of the argument lplanid leads to sql injection. The attack may be initiated remotely. The exploit has been...

Sql injection

A vulnerability was found in SourceCodester Loan Management System and classified as critical. This issue affects some unknown processing of the file deletelplan.php. The manipulation of the argument lplanid leads to sql injection. The attack may be initiated remotely. The exploit has been...

CVE-2022-2667 SourceCodester Loan Management System delete_lplan.php sql injection

A vulnerability was found in SourceCodester Loan Management System and classified as critical. This issue affects some unknown processing of the file deletelplan.php. The manipulation of the argument lplanid leads to sql injection. The attack may be initiated remotely. The exploit has been...

CVE-2022-2667 SourceCodester Loan Management System delete_lplan.php sql injection

A vulnerability was found in SourceCodester Loan Management System and classified as critical. This issue affects some unknown processing of the file deletelplan.php. The manipulation of the argument lplanid leads to sql injection. The attack may be initiated remotely. The exploit has been...

CVE-2022-2667

CVE-2022-2667 affects SourceCodester Loan Management System, specifically the delete_lplan.php flow. The vulnerability stems from improper handling/manipulation of the lplan_id parameter, enabling SQL injection. It is described as exploitable remotely and has been disclosed publicly. Several conn...

Loan Management System OOP SQL注入漏洞

Loan Management System OOP is a loan management system by razormist individual developers. A SQL injection vulnerability exists in Loan Management System OOP, which results from a sql injection caused by the parameter lplanid...

MIMOEmptyVault.sol executeOperation() does not transfer the Vault leftover assets to the owner, it is locked in the MIMOEmptyVault

Lines of code Vulnerability details Impact MIMOEmptyVault.sol executeAction is supposed to pay off the debt and return the leftover assets to the owner of the Vault But In fact the emptyVault contract, after executing the executionOperation, only pays back the flash loan, and does not transfer th...