CVE-2024-2573 is a high severity (CVSS 7.3) execution after redirect flaw in SourceCodester Employee Task Management System 1.0. The task-info.php page redirects unauthorised visitors but keeps running its code. The record lists no fixed version, so restrict access or change the code.
What's affected
SourceCodester Employee Task Management System 1.0, as listed in the record's CPE data. The affected file is /task-info.php. The page redirects but keeps executing, which is the execution after redirect weakness. Any copy of that release should be assumed affected.
The NVD record scores it 7.3 (high) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, published 2024-03-18. The weakness is classed as CWE-698 (execution after redirect).
The record names no fixed version and I found no vendor patch in its references. This is a small PHP project of the kind distributed as sample code, so a patch from the original author is unlikely to arrive on any schedule you can plan around.
How to check if you're exposed
This is source code you deploy, so start with the version. Check the version file, the release tag or the download you used, and confirm whether it is SourceCodester Employee Task Management System 1.0.
Then look for the vulnerable file in your web root:
find /var/www -name 'task-info.php' 2>/dev/null
If the file exists on a server that anyone other than you can reach, assume it is exposed. Web server logs for the file name can show who has requested it.
What to do now
- Find every instance of the application, including test and demo copies, and note who can reach it.
- Take it off any network that is not trusted until it is fixed or replaced.
- If you must keep it, change the code yourself using the fix described under Why it matters, and test it.
- Put the application behind a login at the web server or a VPN so unauthenticated visitors cannot reach it.
- Review the application and database logs for unexpected requests to task-info.php.
- Plan a move to a maintained product if the data is business relevant.
Why it matters
The weakness is execution after redirect. The page sends the browser to a login or error page, but the server keeps running the rest of the script. The redirect is only a hint to the browser, so a client that ignores it still receives whatever the script goes on to produce, and any action in the script still runs.
The fix is small and well known. Stop execution right after sending a redirect, and check the session and the role on the server before doing any work. If the page performs a change, check the permission before the change, not just before drawing the page.
This CVE is not on the CISA Known Exploited Vulnerabilities list (the record's KEV flag is false). Exploit details are not repeated here, because this guide is about defence.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan lists the open source packages in a project and flags known vulnerabilities, and the Gold directory tracks this CVE. Reachability analysis helps decide which findings in your own code actually matter.
Quick check
What does execution after redirect mean for task-info.php?
The server sends a redirect to the browser but does not stop the script, so the rest of the page logic can still run for a visitor who ignores the redirect.
Sources
Last reviewed: 19 October 2026.
