CVE-2024-11632

Summary

CVE-2024-11632 is a newly disclosed critical vulnerability affecting the Simple Car Rental System 1.0. The issue lies in an unknown function of the /book_car.php file, which is susceptible to SQL injection. Maliciously crafted input in the arguments fname, id_no, gender, email, phone, and location can be exploited remotely. While the initial advisory focused on the "fname" parameter, further analysis reveals that other arguments might also be vulnerable. The exploit for this vulnerability has been made public, increasing the risk of potential attacks.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.