CVE-2024-48579
Improper Control of Generation of Code ('Code Injection') (CWE-94)
Summary
SQL Injection vulnerability in Best House rental management system project in php v.1.0 allows a remote attacker to execute arbitrary code via the username parameter of the login request.
Impact
This vulnerability has a severe impact potential. It allows remote attackers to execute arbitrary code on the affected system, which can lead to complete system compromise. The attacker can potentially gain unauthorized access to sensitive data, modify or delete information, and potentially take control of the entire system. Given that the vulnerability is in the login request, it could be exploited before authentication, increasing its severity.
Exploitation
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Patch
As of the provided information, there is no mention of an available patch. The affected software is Best House rental management system project in php v.1.0, and users should monitor for updates from the vendor Mayurik.
Mitigation
1. Implement input validation and sanitization for all user inputs, especially the username parameter in the login request. 2. Use prepared statements or parameterized queries for database interactions to prevent SQL injection. 3. Apply the principle of least privilege to database accounts used by the application. 4. Implement Web Application Firewall (WAF) rules to detect and block SQL injection attempts. 5. Regularly update and patch the Best House rental management system as soon as fixes become available. 6. Consider implementing multi-factor authentication to add an extra layer of security to the login process. 7. Monitor system logs for any suspicious activities or unauthorized access attempts.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Timeline
NVD published the first details for CVE-2024-48579
Feedly found the first article mentioning CVE-2024-48579. See article
Feedly estimated the CVSS score as HIGH
A CVSS base score of 9.8 has been assigned.
EPSS Score was set to: 0.04% (Percentile: 9.8%)