CVE-2024-24142
Published: 13 February 2024
Summary
CVE-2024-24142 is a critical-severity SQL Injection (CWE-89) vulnerability in Rems School Task Manager. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 6.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
Sourcecodester School Task Manager version 1.0 contains a SQL injection vulnerability (CWE-89) that can be triggered through the subject parameter. The flaw received a CVSS 3.1 score of 9.8, reflecting network-accessible exploitation without authentication or user interaction and resulting in complete compromise of confidentiality, integrity, and availability.
An unauthenticated attacker can supply a crafted subject value over the network to execute arbitrary SQL commands against the underlying database. Successful exploitation allows extraction or modification of stored data, privilege escalation within the application, or disruption of service, all without requiring prior credentials.
Public proof-of-concept code demonstrating the injection has been posted to GitHub. The associated EPSS score stands at 0.1031 with no material increase since disclosure, indicating moderate but stable interest in exploitation. No vendor advisory or patch information is referenced in the available sources.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-21566
Vulnerability details
Sourcecodester School Task Manager 1.0 allows SQL Injection via the 'subject' parameter.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.