CVE-2024-13092

CVE-2024-13092 is a critical SQL injection vulnerability in code-projects Job Recruitment 1.0, affecting unknown code within the file /_parse/_call_job/search_ajax.php in the Job Post Handler component. The issue arises from manipulation of the 'n' argument, as classified under CWE-74 (Improper Neutralization of Special Elements used in an SQL Command) and CWE-89 (SQL Injection). It carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) and was published on 2025-01-02.

A remote attacker with low privileges can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation enables limited impacts on confidentiality, integrity, and availability, potentially allowing unauthorized access, modification, or disruption of job-related data handled by the component.

Advisories from sources like VulDB (ctiid.289900, id.289900) and a public exploit disclosure on GitHub (UnrealdDei/cve/sql9.md) confirm the vulnerability's remote exploitability, with the proof-of-concept made publicly available. No specific patches or mitigation steps are detailed in the provided references, though the original project site at code-projects.org may offer context for updates.