CVE-2024-48245

Vehicle Management System 1.0 is vulnerable to SQL Injection. A guest user can exploit vulnerable POST parameters in various administrative actions, such as booking a vehicle or confirming a booking. The affected parameters include "Booking ID", "Action Name", and "Payment Confirmation ID", which are present in /newvehicle.php and /newdriver.php.

CVSS v3.1

7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS

1.04% chance of exploitation in the next 30 days, 62th percentile

Published

2025-01-07

Updated

2026-07-05

Proof-of-concept exploits (1)

• ShadowByte1/CVE-2024-482451★ · 2024-12-23

References

• CVE Record
• NVD entry

Related

• CVE-2024-48246
• CVE-2024-53345
• CVE-2026-42154
• CVE-2024-48238
• CVE-2024-48233
• CVE-2024-48248