Exploit
CVE-2024-7226

Cross-Site Request Forgery (CSRF) (CWE-352)

Published: Jul 30, 2024 / Updated: 3mo ago

010
CVSS 6.9EPSS 0.05%Medium
CVE info copied to clipboard

Summary

A vulnerability has been identified in SourceCodester Medicine Tracker System version 1.0. The vulnerability affects the Password Change Handler component, specifically in the file /classes/Users.php?f=save_user. This issue has been classified as a Cross-Site Request Forgery (CSRF) vulnerability. The attack can be initiated remotely and requires user interaction. The exploit has been publicly disclosed.

Impact

The impact of this vulnerability is severe. It allows remote attackers to perform unauthorized actions on behalf of authenticated users. The CVSS v3.1 base score is 8.8 (High), indicating significant potential for harm. The vulnerability could lead to unauthorized changes to user accounts, data manipulation, or other malicious actions, compromising the integrity and confidentiality of the system. The CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates that the attack vector is network-based, requires low attack complexity, no privileges, and user interaction. It has a high impact on confidentiality, integrity, and availability.

Exploitation

One proof-of-concept exploit is available on github.com. There is no evidence of proof of exploitation at the moment.

Patch

As of the latest information provided, there is no mention of an official patch being available for this vulnerability. Users of SourceCodester Medicine Tracker System 1.0 should be on high alert and look for updates from the vendor.

Mitigation

While waiting for an official patch, consider implementing the following mitigation strategies: 1. Implement strong CSRF tokens in all forms and state-changing requests. 2. Use the 'SameSite' attribute on cookies to limit CSRF attacks. 3. Implement additional authentication steps for sensitive actions. 4. Educate users about the risks of clicking on unknown links while authenticated. 5. Consider temporarily disabling the affected component if possible without disrupting critical operations. 6. Monitor for any suspicious activity related to user account changes or unauthorized actions.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Timeline

CVE Assignment

NVD published the first details for CVE-2024-7226

Jul 30, 2024 at 9:15 AM
First Article

Feedly found the first article mentioning CVE-2024-7226. See article

Jul 30, 2024 at 9:27 AM / National Vulnerability Database
CVSS Estimate

Feedly estimated the CVSS score as HIGH

Jul 30, 2024 at 9:27 AM
EPSS

EPSS Score was set to: 0.05% (Percentile: 16.2%)

Jul 31, 2024 at 10:23 AM
CVSS

A CVSS base score of 8.8 has been assigned.

Aug 13, 2024 at 2:20 PM / nvd
Proof of Concept (PoC) Released

A proof of concept exploit has been released

Aug 13, 2024 at 5:11 PM
CVSS

A CVSS base score of 8.8 has been assigned.

Oct 28, 2024 at 9:09 PM / nvd
Static CVE Timeline Graph

Affected Systems

Oretnom23/medicine_tracker_system
+null more

Exploits

https://github.com/Xu-Mingming/cve/blob/main/CSRF2.md
+null more

Attack Patterns

CAPEC-111: JSON Hijacking (aka JavaScript Hijacking)
+null more

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI