CVE-2024-10140

MEDIUM

Pharmacy Management System 1.0 - SQL Injection

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2024-10140. PoCs published by holypryx.

AI-analyzed exploit summary The script tests for a SQL Injection vulnerability in the 'id' parameter of the '/php/manage_supplier.php' endpoint by using a time-based BENCHMARK payload. It measures response time to infer vulnerability but does not exploit it further.

Description

A vulnerability, which was classified as critical, has been found in code-projects Pharmacy Management System 1.0. Affected by this issue is some unknown functionality of the file /manage_supplier.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

Exploits (1)

nomisec SCANNER 2 stars
by holypryx · poc
https://github.com/holypryx/CVE-2024-10140

The script tests for a SQL Injection vulnerability in the 'id' parameter of the '/php/manage_supplier.php' endpoint by using a time-based BENCHMARK payload. It measures response time to infer vulnerability but does not exploit it further.

Classification
Scanner 90%
Attack Type
Sqli
Complexity
Trivial
Reliability
Reliable
Target: Unknown (endpoint suggests a PHP-based supplier management system)
Auth required
Prerequisites: Valid target URL · Valid session cookies (PHPSESSID)
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (5)

Core 5
Core References
Third Party Advisory, VDB Entry vdb-entry technical-description
https://vuldb.com/?id.280928
Permissions Required, Third Party Advisory, VDB Entry signature permissions-required
https://vuldb.com/?ctiid.280928
Third Party Advisory, VDB Entry third-party-advisory
https://vuldb.com/?submit.425348
Product product
https://code-projects.org/

Scores

CVSS v3 6.3
EPSS 0.0131
EPSS Percentile 66.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-89
Status published
Products (1)
code-projects/pharmacy_management_system 1.0
Published Oct 19, 2024
Tracked Since Feb 18, 2026