CVE-2024-12937

MEDIUM

Code-projects Simple Admin Panel - Injection

Title source: rule

Description

A vulnerability, which was classified as critical, was found in code-projects Simple Admin Panel 1.0. Affected is an unknown function of the file addVariationController.php. The manipulation of the argument qty leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

References (5)

[Product] https://code-projects.org/

[Permissions Required, VDB Entry] https://vuldb.com/?ctiid.289290

[Third Party Advisory, VDB Entry] https://vuldb.com/?id.289290

[Third Party Advisory, VDB Entry] https://vuldb.com/?submit.468134

[Product] https://code-projects.org/simple-admin-panel-in-php-with-source-code/

Scores

CVSS v3 6.3

EPSS 0.0008

EPSS Percentile 23.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Classification

CWE

CWE-74 CWE-89

Status published

Affected Products (1)

code-projects/simple_admin_panel

Timeline

Published Dec 26, 2024

Tracked Since Feb 18, 2026