CVE-2024-8945

medium · 5.3

A vulnerability has been found in CodeCanyon RISE Ultimate Project Manager 3.7.0 and classified as critical. This vulnerability affects unknown code of the file /index.php/dashboard/save. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component.

5.3

CVSS

16.0%

EPSS (exploit prob.)

97th

EPSS percentile

2024-09-17

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-89

Affected products

Vendor	Product	Affected versions
fairsketch	rise_ultimate_project_manager	3.7.0

Check a specific version with /api/v1/cve/match.

References

https://bytium.com/sql-injection-vulnerability-identified-in-rise-crm/
https://vuldb.com/?ctiid.277762
https://vuldb.com/?id.277762
https://vuldb.com/?submit.409096

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2024-8945