CVE-2024-51030
Published: 08 November 2024
Summary
CVE-2024-51030 is a medium-severity SQL Injection (CWE-89) vulnerability in Oretnom23 Cab Management System. Its CVSS base score is 6.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 7.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2024-51030 is a SQL injection vulnerability affecting the manage_client.php and view_cab.php files in Sourcecodester Cab Management System version 1.0. The flaw, tracked under CWE-89, permits unsanitized input through the id parameter to be passed directly into SQL queries, enabling arbitrary command execution against the underlying database. It carries a CVSS 3.1 score of 6.5, reflecting network attack vector, low complexity, and low privileges required.
An authenticated remote attacker can supply a crafted id value to the affected endpoints and retrieve or manipulate database contents, resulting in unauthorized disclosure of sensitive information such as client or cab records. No user interaction is needed, and the attack can be performed over the network without altering scope.
Public references include a proof-of-concept on GitHub and the vendor's product page, but no official patch or mitigation guidance is provided in the available sources. The EPSS score has remained flat at 0.0764 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-45270
Vulnerability details
A SQL injection vulnerability in manage_client.php and view_cab.php of Sourcecodester Cab Management System 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter, leading to unauthorized access and potential compromise of sensitive data within the database.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in web application enables exploitation of public-facing application (T1190) and arbitrary data collection from databases (T1213.006).
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.