CVE-2024-26492

MEDIUM

Online Diagnostic Lab Management System 1.0 - RCE

Title source: llm

Description

An issue in Online Diagnostic Lab Management System 1.0 allows a remote attacker to gain control of a 'Staff' user account via a crafted POST request using the id, email, password, and cpass parameters.

Exploits (1)

exploitdb WORKING POC

by Himash · textwebappsphp

https://www.exploit-db.com/exploits/50660

View Code ZIP pw:eip

References (2)

[Exploit, Third Party Advisory] https://packetstormsecurity.com/files/165555/Online-Diagnostic-Lab-Management-System-1.0-Missing-Access-Control.html

[Exploit, Third Party Advisory] https://www.exploit-db.com/exploits/50660

Scores

CVSS v3 6.3

EPSS 0.0043

EPSS Percentile 62.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

Status published

Products (1)

oretnom23/online_diagnostic_lab_management_system 1.0

Published Mar 07, 2024

Tracked Since Feb 18, 2026