CVE-2024-7454
Published: 04 August 2024
Summary
CVE-2024-7454 is a medium-severity SQL Injection (CWE-89) vulnerability in Oretnom23 Clinic\'S Patient Management System. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 25.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-48376
Vulnerability details
A vulnerability, which was classified as critical, has been found in SourceCodester Clinics Patient Management System 1.0. Affected by this issue is the function patient_name of the file patients.php. The manipulation leads to sql injection. The attack may be launched…
more
remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-273548.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The SQL injection vulnerability in a public-facing web application (CVE-2024-7454) enables exploitation for initial access (T1190) and unauthorized data collection from the database (T1213.006).
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.