CVE-2024-13204
Published: 09 January 2025
Summary
CVE-2024-13204 is a medium-severity Injection (CWE-74) vulnerability in Kurniaramadhan E-Commerce-Php. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 12.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2024-13204 is a SQL injection vulnerability affecting kurniaramadhan E-Commerce-PHP version 1.0. The issue resides in an unknown functionality within the /blog-details.php file, where the blog_id parameter can be manipulated to inject malicious SQL payloads. Rated as critical by some sources with a CVSS v3.1 base score of 5.5 (AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L), it falls under CWE-74 and CWE-89.
A remote attacker with low privileges (PR:L) can exploit this vulnerability by manipulating the blog_id argument, requiring user interaction (UI:R) such as clicking a crafted link. Successful exploitation enables limited impacts, including low confidentiality, integrity, and availability disruptions, such as unauthorized data access or modification within the scope of the low-privilege context.
Advisories from VulDB and Web Security Insights note that the exploit has been publicly disclosed and is available for use, with the vendor contacted early but providing no response or patches. No official mitigations or updates are mentioned in the available references.
The public disclosure of the exploit increases the risk for deployments of this software, particularly given the lack of vendor engagement.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-51426
Vulnerability details
A vulnerability was found in kurniaramadhan E-Commerce-PHP 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /blog-details.php. The manipulation of the argument blog_id leads to sql injection. The attack can be…
more
launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct SQL injection in public-facing web app (/blog-details.php) enables remote exploitation of the application for data access/modification.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 directly prevents SQL injection by requiring validation of untrusted inputs like the blog_id parameter in /blog-details.php.
SI-2 mandates identification and remediation of the specific SQL injection flaw in the vulnerable E-Commerce-PHP application.
RA-5 enables detection of SQL injection vulnerabilities like CVE-2024-13204 through vulnerability scanning and monitoring.