CVE-2024-55509

The vulnerability exists in the 'id' parameter of the delete.php component, which is not properly sanitized before use in an SQL query. An attacker can inject malicious SQL code into this parameter, leading to execution of unintended database operations. Through a properly crafted query, arbitrary code execution (RCE) and privilege escalation in the system are possible.

An attacker can gain full access to the database, execute arbitrary code on the server, and escalate their privileges — potentially taking complete control of the system (high confidentiality, integrity, and availability impact).

Apply patches available from the vendor according to the references. Until an update is applied, it is recommended to restrict access to the delete.php component, for example through a Web Application Firewall (WAF) or access control at the web server level.

Codeastro Complaint Management System v.1.0