CVE-2024-31547

The vulnerability results from the lack of proper validation and sanitization of input data passed in the 'id' parameter of HTTP request to the /admin/item/view_item.php file. An attacker can inject malicious SQL queries directly into the URL parameter, which are then executed by the database server without proper filtering. The lack of authentication requirement (PR:N) and user interaction (UI:N) makes the attack remotely exploitable over the network by any person.

An attacker can gain unauthorized access to sensitive data stored in the database (high confidentiality) and modify or delete data in the application database (high integrity).

Patches available from the vendor should be applied according to the references. Additionally, it is recommended to implement parameterized SQL queries (prepared statements) and server-side input validation. It is recommended to restrict access to the administration panel only to trusted IP addresses.

Computer Laboratory Management System v1.0 by Oretnom23