CVE-2024-40443
Published: 13 November 2024
Summary
CVE-2024-40443 is a medium-severity SQL Injection (CWE-89) vulnerability in Oretnom23 Computer Laboratory Management System. Its CVSS base score is 4.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 8.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CVE-2024-40443 is a SQL injection vulnerability, tracked under CWE-89, that affects the Simple Laboratory Management System built with PHP and MySQL version 1.0. The flaw resides in the delete_users function within Useres.php and permits an authenticated remote attacker to inject malicious SQL statements.
An attacker with low-privileged network access can exploit the issue to trigger a denial of service, as reflected in the CVSS 4.3 score that emphasizes availability impact without confidentiality or integrity loss. The attack requires no user interaction and can be launched over the network.
The associated EPSS score has remained flat at 0.0632 with no material increase since disclosure, indicating limited observed exploitation interest to date. Public references consist of a technical gist and GitHub repository that document the vulnerability but provide no official patch or mitigation guidance.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-38459
Vulnerability details
SQL Injection vulnerability in Simple Laboratory Management System using PHP and MySQL v.1.0 allows a remote attacker to cause a denial of service via the delete_users function in the Useres.php
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing web application (Users.php) enables exploitation of public-facing application (T1190) and facilitates denial of service via time-based delays like SLEEP() causing application exhaustion or unavailability (T1499.004).
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.