Cyber Resilience

CVE-2024-48427

High

Published: 24 October 2024

Published
24 October 2024
Modified
31 October 2024
KEV Added
—
Patch
—
CVSS Score v3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.1716 95.2th percentile
Risk Priority 28 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-48427 is a high-severity SQL Injection (CWE-89) vulnerability in Oretnom23 Packers And Movers Management System. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 4.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

Deeper analysis

CVE-2024-48427 is a SQL injection vulnerability affecting Sourcecodester Packers and Movers Management System version 1.0. The flaw resides in the id parameter passed to the /mpms/admin/?page=services/manage_service endpoint and is tracked under CWE-89.

Remote authenticated users can supply crafted input to the vulnerable parameter and execute arbitrary SQL commands. Successful exploitation grants full read, write, and delete access within the application's database scope, corresponding to the reported CVSS 3.1 score of 8.8.

Public references include a proof-of-concept on GitHub and the original product page on Sourcecodester; neither source describes vendor patches or configuration mitigations.

The associated EPSS score stands at 0.1716 with no material increase from its recorded peak.

EU & UK References

Vulnerability details

A SQL injection vulnerability in Sourcecodester Packers and Movers Management System v1.0 allows remote authenticated users to execute arbitrary SQL commands via the id parameter in /mpms/admin/?page=services/manage_service&id

CWE(s)
CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1213.006 Databases Collection
Adversaries may leverage databases to mine valuable information.
attack.mitre.org →
Why these techniques?

SQL injection vulnerability allows remote authenticated users to execute arbitrary SQL commands on a public-facing web application (T1190), facilitating unauthorized access to and collection of data from databases (T1213.006).

Affected Assets

oretnom23
packers and movers management system
1.0

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

CA-8 Penetration Testing
addresses: CWE-89

Penetration testing uses SQL injection payloads against database interfaces, identifying and supporting fixes for SQL injection weaknesses.

SI-10 Information Input Validation
addresses: CWE-89

Validates query inputs to prevent SQL syntax or command manipulation.

References