Cyber Resilience

CVE-2024-40443

MediumPublic PoC

Published: 13 November 2024

Published
13 November 2024
Modified
16 April 2025
KEV Added
Patch
CVSS Score v3.1 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
EPSS Score 0.0632 91.2th percentile
Risk Priority 12 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-40443 is a medium-severity SQL Injection (CWE-89) vulnerability in Oretnom23 Computer Laboratory Management System. Its CVSS base score is 4.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 8.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

CVE-2024-40443 is a SQL injection vulnerability, tracked under CWE-89, that affects the Simple Laboratory Management System built with PHP and MySQL version 1.0. The flaw resides in the delete_users function within Useres.php and permits an authenticated remote attacker to inject malicious SQL statements.

An attacker with low-privileged network access can exploit the issue to trigger a denial of service, as reflected in the CVSS 4.3 score that emphasizes availability impact without confidentiality or integrity loss. The attack requires no user interaction and can be launched over the network.

The associated EPSS score has remained flat at 0.0632 with no material increase since disclosure, indicating limited observed exploitation interest to date. Public references consist of a technical gist and GitHub repository that document the vulnerability but provide no official patch or mitigation guidance.

EU & UK References

Vulnerability details

SQL Injection vulnerability in Simple Laboratory Management System using PHP and MySQL v.1.0 allows a remote attacker to cause a denial of service via the delete_users function in the Useres.php

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
Why these techniques?

SQL injection in public-facing web application (Users.php) enables exploitation of public-facing application (T1190) and facilitates denial of service via time-based delays like SLEEP() causing application exhaustion or unavailability (T1499.004).

Affected Assets

oretnom23
computer laboratory management system
1.0

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-89

Penetration testing uses SQL injection payloads against database interfaces, identifying and supporting fixes for SQL injection weaknesses.

addresses: CWE-89

Validates query inputs to prevent SQL syntax or command manipulation.

References