CVE-2024-13204
Published: 09 January 2025
Description
A vulnerability was found in kurniaramadhan E-Commerce-PHP 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /blog-details.php. The manipulation of the argument blog_id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Security Summary
CVE-2024-13204 is a SQL injection vulnerability affecting kurniaramadhan E-Commerce-PHP version 1.0. The issue resides in an unknown functionality within the /blog-details.php file, where the blog_id parameter can be manipulated to inject malicious SQL payloads. Rated as critical by some sources with a CVSS v3.1 base score of 5.5 (AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L), it falls under CWE-74 and CWE-89.
A remote attacker with low privileges (PR:L) can exploit this vulnerability by manipulating the blog_id argument, requiring user interaction (UI:R) such as clicking a crafted link. Successful exploitation enables limited impacts, including low confidentiality, integrity, and availability disruptions, such as unauthorized data access or modification within the scope of the low-privilege context.
Advisories from VulDB and Web Security Insights note that the exploit has been publicly disclosed and is available for use, with the vendor contacted early but providing no response or patches. No official mitigations or updates are mentioned in the available references.
The public disclosure of the exploit increases the risk for deployments of this software, particularly given the lack of vendor engagement.
Details
- CWE(s)