CVE-2024-2575: oretnom23 employee_task_management_system

Vulnerability summary

CVE-2024-2575 is a critical (CVSS 9.8) vulnerability in oretnom23 employee_task_management_system. EPSS estimates a 0.67% chance of exploitation in the next 30 days, higher than 51% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 18-03-2024
   PublishedVulnerability first disclosed.
2. 08-08-2024
   Last modifiedVulnerability information updated.

Description

A vulnerability, which was classified as critical, has been found in SourceCodester Employee Task Management System 1.0. Affected by this issue is some unknown functionality of the file /task-details.php. The manipulation of the argument task_id leads to authorization bypass. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-257078 is the identifier assigned to this vulnerability.

• CWE-639Authorization Bypass Through User-Controlled KeyThe system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.