CVE-2024-29390
June 20, 2024, 9:15 p.m.
None
No Score
Description
Daily Expenses Management System version 1.0, developed by PHP Gurukul, contains a time-based blind SQL injection vulnerability in the 'add-expense.php' page. An attacker can exploit the 'item' parameter in a POST request to execute arbitrary SQL commands in the backend database. This can be done by injecting specially crafted SQL queries that make the database perform time-consuming operations, thereby confirming the presence of the SQL injection vulnerability based on the delay in the server's response.
Product(s) Impacted
| Product | Versions |
|---|---|
| Daily Expenses Management System |
|
Weaknesses
Common security weaknesses mapped to this vulnerability.
Tags
Timeline
Published: June 20, 2024, 9:15 p.m.
Last Modified: June 20, 2024, 9:15 p.m.
Last Modified: June 20, 2024, 9:15 p.m.
Status : Received
CVE has been recently published to the CVE List and has been received by the NVD.
More infoSource
cve@mitre.org
*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.