CVE-2024-40480

Summary

CVE-2024-40480 is a newly discovered access control vulnerability affecting the Kashipara Online Exam System v1.0. The flaw, present in both /admin/update.php and /admin/dashboard.php, enables unauthenticated attackers to access the administrator dashboard and delete valid user accounts directly through URL manipulation. This issue poses a significant risk, as it bypasses authentication requirements and grants unauthorized access to sensitive information and functionality. Attackers can exploit this vulnerability to disrupt services, steal data, or launch further attacks against affected systems. System administrators are urged to patch these components immediately to mitigate the risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.