CVE-2024-48245

Summary

CVE-2024-48245 is a new SQL Injection vulnerability affecting Vehicle Management System 1.0. This issue allows unauthenticated guests to manipulate vulnerable POST parameters during administrative actions like booking a vehicle or confirming a reservation. The exploit can be carried out on /newvehicle.php and /newdriver.php pages by targeting parameters such as "Booking ID", "Action Name", and "Payment Confirmation ID". This vulnerability poses a significant risk, as attackers can inject malicious SQL queries to access, modify, or delete sensitive data. Users are strongly advised to patch their systems as soon as possible to mitigate this threat.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.