CVE-2024-7169 SourceCodester School Fees Payment System ajax.php cross-site request forgery
Attackers can perform unauthorized actions on behalf of authenticated users in the School Fees Payment System via CSRF.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-7169?
CVE-2024-7169 is a medium-severity vulnerability in SourceCodester School Fees Payment System, published on 28 Jul 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability classified as problematic has been found in SourceCodester School Fees Payment System 1.0. This affects an unknown part of the file /ajax.php. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-272583.
Weakness: CWE-352
Which versions are affected by CVE-2024-7169?
It affects 1 product.
Products include Oretnom23 School Fees Payment System.
How do I fix CVE-2024-7169?
No fix has been published for CVE-2024-7169 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-7169 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-7169 exists.
Other vulnerabilities in SourceCodester School Fees Payment System
- CVE-2024-7164 SourceCodester School Fees Payment System sql injection
- CVE-2024-7165 SourceCodester School Fees Payment System view_payment.php sql injection
- CVE-2024-7166 SourceCodester School Fees Payment System receipt.php sql injection
- CVE-2024-7167 SourceCodester School Fees Payment System manage_course.php sql injection
- CVE-2024-7168 SourceCodester School Fees Payment System manage_user.php sql injection
Sources
Also known as GHSA-2258-2x7m-c8q2.