CVE-2024-7367 SourceCodester Simple Realtime Quiz System ajax.php cross-site request forgery
Attackers can trick authenticated users into modifying quiz system data via a cross-site request forgery vulnerability in the ajax.php file.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-7367?
CVE-2024-7367 is a medium-severity vulnerability in SourceCodester Simple Realtime Quiz System, published on 1 Aug 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability, which was classified as problematic, was found in SourceCodester Simple Realtime Quiz System 1.0. This affects an unknown part of the file /ajax.php?action=save_user. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-273351.
Weakness: CWE-352
Which versions are affected by CVE-2024-7367?
It affects 1 product.
Products include Oretnom23 Simple Realtime Quiz System.
How do I fix CVE-2024-7367?
No fix has been published for CVE-2024-7367 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-7367 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-7367 exists.
Other vulnerabilities in SourceCodester Simple Realtime Quiz System
- CVE-2024-7369 SourceCodester Simple Realtime Quiz System Login ajax.php sql injection
- CVE-2024-7373 SourceCodester Simple Realtime Quiz System ajax.php sql injection
- CVE-2024-7374 SourceCodester Simple Realtime Quiz System manage_user.php sql injection
- CVE-2024-7375 SourceCodester Simple Realtime Quiz System my_quiz_result.php sql injection
- CVE-2024-7376 SourceCodester Simple Realtime Quiz System print_quiz_records.php sql injection
Sources
Also known as GHSA-939p-28h4-46p5.