CVE-2024-11487

Summary

CVE-2024-11487 is a critical vulnerability affecting the Code4Berry Decoration Management System 1.0. The issue lies in the Between Dates Reports component and specifically in the file /decoration/admin/btndates_report.php, where an sql injection vulnerability was discovered. This flaw can be exploited by manipulating the fromdate/todate argument and can be initiated remotely. Despite early disclosure to the vendor, they have not responded or taken any action to address this vulnerability, leaving systems using this software exposed and potentially at risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.