CVE-2024-55232: An IDOR
Source CVE Database V5
Not known to be exploited · CVSS 5.4 Medium.
Data as of 26 Oct 2026, 11:42 UTC
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 32% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:LExploitation evidence
Disclosed: evidence found.
CVE published 18 Dec 2024
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
To mitigate CVE-2024-55232, organizations should immediately review and update the authorization logic in the manage-notes.php module to ensure that users can only delete notes they own. Implement strict server-side access control checks that verify the ownership of the note before processing deletion requests. Conduct a thorough code audit for similar IDOR issues in other modules. Employ role-based access controls (RBAC) and the principle of least privilege to limit user permissions. Monitor logs for suspicious deletion activities and implement alerting for anomalous behavior. If possible, isolate the notes management system behind additional authentication layers or VPNs to reduce exposure. Until an official patch is released, consider disabling the note deletion feature or restricting it to trusted administrators. Educate users about the importance of strong authentication credentials to reduce the risk of account compromise.
Description
An IDOR vulnerability in the manage-notes.php module in PHPGurukul Online Notes Sharing Management System v1.0 allows unauthorized users to delete notes belonging to other accounts due to missing authorization checks. This flaw enables attackers to delete another user's information.