Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.3
CVE-2024-8561: SourceCodester PHP CRUD 1.0: Remote SQL Injection in Delete Function
CVE-2024-8561 · published 2 years ago
Summary
A critical flaw in the delete function of SourceCodester PHP CRUD 1.0 allows an attacker to inject malicious SQL code, potentially exposing sensitive data or compromising the entire system. This vulnerability can be exploited remotely, so it's essential to update the software as soon as possible to prevent unauthorized access. Update to the latest version of SourceCodester PHP CRUD to fix this issue.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| rems | php_crud |
1.0 cpe:2.3:a:rems:php_crud:1.0:*:*:*:*:*:*:* |
Original advisory text
A vulnerability has been found in SourceCodester PHP CRUD 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /endpoint/delete.php of the componen...
A vulnerability has been found in SourceCodester PHP CRUD 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /endpoint/delete.php of the component Delete Person Handler. The manipulation of the argument person leads to sql injection. The attack can be launched remotely.
References
- https://vuldb.com/?ctiid.276781 Permissions Required
- https://vuldb.com/?id.276781 Permissions Required Third Party Advisory
- https://vuldb.com/?submit.403651 Third Party Advisory VDB Entry
- https://www.sourcecodester.com/ Product
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-89SQL Injection
Timeline
Published7 Sep 2024
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2024-8561 · NVD
Track software like this
Free during beta