From f1a84e70f98b6b30d4155a38195499b4bbdd0c7a Mon Sep 17 00:00:00 2001 From: cvelistV5 Github Action Date: Thu, 7 Mar 2024 23:35:47 +0000 Subject: [PATCH] 2 changes (2 new | 0 updated): - 2 new CVEs: CVE-2024-2271, CVE-2024-2272 - 0 updated CVEs: --- cves/2024/2xxx/CVE-2024-2271.json | 143 ++++++++++++++++++++++++++++++ cves/2024/2xxx/CVE-2024-2272.json | 143 ++++++++++++++++++++++++++++++ cves/delta.json | 18 ++-- cves/deltaLog.json | 41 +++++---- 4 files changed, 318 insertions(+), 27 deletions(-) create mode 100644 cves/2024/2xxx/CVE-2024-2271.json create mode 100644 cves/2024/2xxx/CVE-2024-2272.json diff --git a/cves/2024/2xxx/CVE-2024-2271.json b/cves/2024/2xxx/CVE-2024-2271.json new file mode 100644 index 000000000000..b2bc7eee4ec5 --- /dev/null +++ b/cves/2024/2xxx/CVE-2024-2271.json @@ -0,0 +1,143 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.0", + "cveMetadata": { + "cveId": "CVE-2024-2271", + "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", + "state": "PUBLISHED", + "assignerShortName": "VulDB", + "dateReserved": "2024-03-07T14:34:44.799Z", + "datePublished": "2024-03-07T23:31:04.547Z", + "dateUpdated": "2024-03-07T23:31:04.547Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", + "shortName": "VulDB", + "dateUpdated": "2024-03-07T23:31:04.547Z" + }, + "title": "keerti1924 Online-Book-Store-Website HTTP POST Request shop.php sql injection", + "problemTypes": [ + { + "descriptions": [ + { + "type": "CWE", + "cweId": "CWE-89", + "lang": "en", + "description": "CWE-89 SQL Injection" + } + ] + } + ], + "affected": [ + { + "vendor": "keerti1924", + "product": "Online-Book-Store-Website", + "versions": [ + { + "version": "1.0", + "status": "affected" + } + ], + "modules": [ + "HTTP POST Request Handler" + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A vulnerability classified as critical has been found in keerti1924 Online-Book-Store-Website 1.0. This affects an unknown part of the file /shop.php of the component HTTP POST Request Handler. The manipulation of the argument product_name leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-256041 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way." + }, + { + "lang": "de", + "value": "Es wurde eine Schwachstelle in keerti1924 Online-Book-Store-Website 1.0 entdeckt. Sie wurde als kritisch eingestuft. Hiervon betroffen ist ein unbekannter Codeblock der Datei /shop.php der Komponente HTTP POST Request Handler. Mittels dem Manipulieren des Arguments product_name mit unbekannten Daten kann eine sql injection-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk angegangen werden. Der Exploit steht zur öffentlichen Verfügung." + } + ], + "metrics": [ + { + "cvssV3_1": { + "version": "3.1", + "baseScore": 6.3, + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", + "baseSeverity": "MEDIUM" + } + }, + { + "cvssV3_0": { + "version": "3.0", + "baseScore": 6.3, + "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", + "baseSeverity": "MEDIUM" + } + }, + { + "cvssV2_0": { + "version": "2.0", + "baseScore": 6.5, + "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P" + } + } + ], + "timeline": [ + { + "time": "2024-03-07T00:00:00.000Z", + "lang": "en", + "value": "Advisory disclosed" + }, + { + "time": "2024-03-07T01:00:00.000Z", + "lang": "en", + "value": "VulDB entry created" + }, + { + "time": "2024-03-07T15:52:49.000Z", + "lang": "en", + "value": "VulDB entry last update" + } + ], + "credits": [ + { + "lang": "en", + "value": "Joshua Lictan", + "type": "finder" + }, + { + "lang": "en", + "value": "nochizplz (VulDB User)", + "type": "reporter" + }, + { + "lang": "en", + "value": "nochizplz (VulDB User)", + "type": "analyst" + } + ], + "references": [ + { + "url": "https://vuldb.com/?id.256041", + "name": "VDB-256041 | keerti1924 Online-Book-Store-Website HTTP POST Request shop.php sql injection", + "tags": [ + "vdb-entry", + "technical-description" + ] + }, + { + "url": "https://vuldb.com/?ctiid.256041", + "name": "VDB-256041 | CTI Indicators (IOB, IOC, TTP, IOA)", + "tags": [ + "signature", + "permissions-required" + ] + }, + { + "url": "https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/keerti1924%20Online-Book-Store-Website/Blind%20SQL%20Injection%20%20Shop/Blind%20SQL%20Injection%20Shop.php%20.md", + "tags": [ + "exploit" + ] + } + ] + } + } +} \ No newline at end of file diff --git a/cves/2024/2xxx/CVE-2024-2272.json b/cves/2024/2xxx/CVE-2024-2272.json new file mode 100644 index 000000000000..10546febc6bd --- /dev/null +++ b/cves/2024/2xxx/CVE-2024-2272.json @@ -0,0 +1,143 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.0", + "cveMetadata": { + "cveId": "CVE-2024-2272", + "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", + "state": "PUBLISHED", + "assignerShortName": "VulDB", + "dateReserved": "2024-03-07T14:34:48.063Z", + "datePublished": "2024-03-07T23:31:05.971Z", + "dateUpdated": "2024-03-07T23:31:05.971Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", + "shortName": "VulDB", + "dateUpdated": "2024-03-07T23:31:05.971Z" + }, + "title": "keerti1924 Online-Book-Store-Website HTTP POST Request home.php sql injection", + "problemTypes": [ + { + "descriptions": [ + { + "type": "CWE", + "cweId": "CWE-89", + "lang": "en", + "description": "CWE-89 SQL Injection" + } + ] + } + ], + "affected": [ + { + "vendor": "keerti1924", + "product": "Online-Book-Store-Website", + "versions": [ + { + "version": "1.0", + "status": "affected" + } + ], + "modules": [ + "HTTP POST Request Handler" + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A vulnerability classified as critical was found in keerti1924 Online-Book-Store-Website 1.0. This vulnerability affects unknown code of the file /home.php of the component HTTP POST Request Handler. The manipulation of the argument product_name leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-256042 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way." + }, + { + "lang": "de", + "value": "In keerti1924 Online-Book-Store-Website 1.0 wurde eine Schwachstelle entdeckt. Sie wurde als kritisch eingestuft. Betroffen ist eine unbekannte Verarbeitung der Datei /home.php der Komponente HTTP POST Request Handler. Mittels Manipulieren des Arguments product_name mit unbekannten Daten kann eine sql injection-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk passieren. Der Exploit steht zur öffentlichen Verfügung." + } + ], + "metrics": [ + { + "cvssV3_1": { + "version": "3.1", + "baseScore": 6.3, + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", + "baseSeverity": "MEDIUM" + } + }, + { + "cvssV3_0": { + "version": "3.0", + "baseScore": 6.3, + "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", + "baseSeverity": "MEDIUM" + } + }, + { + "cvssV2_0": { + "version": "2.0", + "baseScore": 6.5, + "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P" + } + } + ], + "timeline": [ + { + "time": "2024-03-07T00:00:00.000Z", + "lang": "en", + "value": "Advisory disclosed" + }, + { + "time": "2024-03-07T01:00:00.000Z", + "lang": "en", + "value": "VulDB entry created" + }, + { + "time": "2024-03-07T15:52:52.000Z", + "lang": "en", + "value": "VulDB entry last update" + } + ], + "credits": [ + { + "lang": "en", + "value": "Joshua Lictan", + "type": "finder" + }, + { + "lang": "en", + "value": "nochizplz (VulDB User)", + "type": "reporter" + }, + { + "lang": "en", + "value": "nochizplz (VulDB User)", + "type": "analyst" + } + ], + "references": [ + { + "url": "https://vuldb.com/?id.256042", + "name": "VDB-256042 | keerti1924 Online-Book-Store-Website HTTP POST Request home.php sql injection", + "tags": [ + "vdb-entry", + "technical-description" + ] + }, + { + "url": "https://vuldb.com/?ctiid.256042", + "name": "VDB-256042 | CTI Indicators (IOB, IOC, TTP, IOA)", + "tags": [ + "signature", + "permissions-required" + ] + }, + { + "url": "https://github.com/skid-nochizplz/skid-nochizplz/blob/main/TrashBin/CVE/keerti1924%20Online-Book-Store-Website/Blind%20SQL%20Injection%20%20Home/Blind%20SQL%20Injection%20Home.php%20.md", + "tags": [ + "exploit" + ] + } + ] + } + } +} \ No newline at end of file diff --git a/cves/delta.json b/cves/delta.json index 166ad2d2ae05..424963947eb0 100644 --- a/cves/delta.json +++ b/cves/delta.json @@ -1,12 +1,18 @@ { - "fetchTime": "2024-03-07T23:29:45.858Z", - "numberOfChanges": 1, + "fetchTime": "2024-03-07T23:35:43.612Z", + "numberOfChanges": 2, "new": [ { - "cveId": "CVE-2024-25327", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2024-25327", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/25xxx/CVE-2024-25327.json", - "dateUpdated": "2024-03-07T23:24:37.711995" + "cveId": "CVE-2024-2271", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2024-2271", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/2xxx/CVE-2024-2271.json", + "dateUpdated": "2024-03-07T23:31:04.547Z" + }, + { + "cveId": "CVE-2024-2272", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2024-2272", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/2xxx/CVE-2024-2272.json", + "dateUpdated": "2024-03-07T23:31:05.971Z" } ], "updated": [], diff --git a/cves/deltaLog.json b/cves/deltaLog.json index 146312b3f136..c2fe8c380cbf 100644 --- a/cves/deltaLog.json +++ b/cves/deltaLog.json @@ -1,4 +1,24 @@ [ + { + "fetchTime": "2024-03-07T23:35:43.612Z", + "numberOfChanges": 2, + "new": [ + { + "cveId": "CVE-2024-2271", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2024-2271", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/2xxx/CVE-2024-2271.json", + "dateUpdated": "2024-03-07T23:31:04.547Z" + }, + { + "cveId": "CVE-2024-2272", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2024-2272", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/2xxx/CVE-2024-2272.json", + "dateUpdated": "2024-03-07T23:31:05.971Z" + } + ], + "updated": [], + "error": [] + }, { "fetchTime": "2024-03-07T23:29:45.858Z", "numberOfChanges": 1, @@ -45306,26 +45326,5 @@ ], "updated": [], "error": [] - }, - { - "fetchTime": "2024-02-06T23:31:50.834Z", - "numberOfChanges": 2, - "new": [ - { - "cveId": "CVE-2024-1264", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2024-1264", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/1xxx/CVE-2024-1264.json", - "dateUpdated": "2024-02-06T23:31:04.547Z" - } - ], - "updated": [ - { - "cveId": "CVE-2023-6238", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2023-6238", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/6xxx/CVE-2023-6238.json", - "dateUpdated": "2024-02-06T23:30:20.019Z" - } - ], - "error": [] } ] \ No newline at end of file