CVE-2024-37858

Critical · CVSS 9.8

Lost and Found Information System — SQL Injection privilege escalation (CWE-89, CWE-269)

CVSS: 9.8; nvd
EPSS: —
KEV: No
Class: other; CWE-89, CWE-269

Description

SQL Injection vulnerability in Lost and Found Information System 1.0 allows a remote attacker to escalate privileges via the id parameter to php-lfis/admin/categories/manage_category.php.

Search profile — drives PoC discovery

Symbols idphp-lfis/admin/categories/manage_category.phpmanage_categoryphp-lfis

Keywords CVE-2024-37858Lost and Found Information SystemSQL Injectionmanage_category.phpphp-lfisprivilege escalationid parametersourcecodester

Versions: 1.0

References

https://packetstormsecurity.com/files/179079/Lost-And-Found-Information-System-1.0-SQL-Injection.html
https://www.sourcecodester.com/
http://lost.com
https://packetstormsecurity.com/files/179079/Lost-And-Found-Information-System-1.0-SQL-Injection.html
https://www.sourcecodester.com/

Status: enriched · ingested 2026-07-05T06:00:39.000Z · profiled 2026-07-06T00:30:39.000Z