CVE-2024-24093

The vulnerability exists in the Personal Information Update functionality. An attacker can enter maliciously crafted input data into the appropriate form field, which is then passed directly to an SQL query without proper validation or sanitization. This makes it possible to modify the logic of the database query and execute arbitrary SQL commands (CWE-89).

An attacker can gain full control over the application's database — read, modify or delete stored data, and potentially execute arbitrary code on the server side, resulting in violations of system confidentiality, integrity and availability.

Patches available from the vendor should be applied in accordance with the references. Additionally, it is recommended to implement parameterized SQL queries and input data validation mechanisms, as well as restrict network access to the application to trusted sources.

Code-Projects Scholars Tracking System version 1.0