CVE-2024-41618 | THREATINT

Description

Money Manager EX WebApp (web-money-manager-ex) 1.2.2 is vulnerable to SQL Injection in the `transaction_delete_group` function. The vulnerability is due to improper sanitization of user input in the `TrDeleteArr` parameter, which is directly incorporated into an SQL query.

PUBLISHED Reserved 2024-07-18 | Published 2024-10-24 | Updated 2024-10-29 | Assigner mitre

References

github.com/moneymanagerex/web-money-manager-ex/issues/51

www.youtube.com/watch?v=JaOrlT9G3yo

github.com/...ommit/f2850b295ee21bc299799343a3bc4d004d05651d

github.com/...gerex/web-money-manager-ex/releases/tag/v1.2.3

cve.org (CVE-2024-41618)

nvd.nist.gov (CVE-2024-41618)

Download JSON