CVE-2024-33958

Description

SQL injection vulnerability in E-Negosyo System affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the server and retrieve all the information stored in 'phonenumber' in '/passwordrecover.php' parameter.

PUBLISHED Reserved 2024-04-29 | Published 2024-08-06 | Updated 2024-08-08 | Assigner INCIBE

Problem types

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Product status

Credits

Rafael Pedrero finder

References

www.incibe.es/...so/multiple-vulnerabilities-janobe-products

cve.org (CVE-2024-33958)

nvd.nist.gov (CVE-2024-33958)

Download JSON