CVE-2024-33957

SQL injection vulnerability in E-Negosyo System affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the server and retrieve all the information stored in 'id' in '/admin/orders/controller.php' parameter

Score

CVSS 3.1 9.8 Critical

Status

Analyzed - cve-coordination@incibe.es

Published

2024-08-06

Last modified

2024-08-06

Weaknesses

CWE-89

Affected products

• E-negosyo System (Janobe)
• Enegosyo System (Janobe)
• Young Entrepreneur E-negosyo System (Janobe)

References

• https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-janobe-products