Lucene search

VulDBVULNRICHMENT:CVE-2024-8558

HistorySep 07, 2024 - 3:31 p.m.

CVE-2024-8558 SourceCodester Food Ordering Management System Price place-order.php improper validation of specified quantity in input

2024-09-0715:31:04

CWE-1284

VulDB

github.com

cve-2024-8558

sourcecodester

food ordering management system

price handler

improper validation

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

CVSS4

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/SC:N/VI:L/SI:N/VA:N/SA:N

AI Score

4.9

Confidence

High

EPSS

0.001

Percentile

47.6%

SSVC

Exploitation

poc

Automatable

Technical Impact

partial

JSON

A vulnerability classified as problematic was found in SourceCodester Food Ordering Management System 1.0. This vulnerability affects unknown code of the file /foms/routers/place-order.php of the component Price Handler. The manipulation of the argument total leads to improper validation of specified quantity in input. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:sourcecodester:food_ordering_management_system:1.0:*:*:*:*:*:*:*"
    ],
    "vendor": "sourcecodester",
    "product": "food_ordering_management_system",
    "versions": [
      {
        "status": "affected",
        "version": "1.0"
      }
    ],
    "defaultStatus": "unknown"
  }
]

References

github.com/Niu-zida/cve/blob/main/Payment%20loopholes.md

vuldb.com/?ctiid.276778

vuldb.com/?id.276778

vuldb.com/?submit.403345

www.sourcecodester.com/

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

CVSS4

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/SC:N/VI:L/SI:N/VA:N/SA:N

AI Score

4.9

Confidence

High

EPSS

0.001

Percentile

47.6%

SSVC

Exploitation

poc

Automatable

Technical Impact

partial

JSON

Related for VULNRICHMENT:CVE-2024-8558