Paper/Archive/CVE-2024-0733

CVE-2024-0733

VulDB — Smsot HTTP POST Request api.php sql injection

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 43.5.435 × 208.7 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

A vulnerability was found in Smsot up to 2.12. It has been classified as critical. Affected is an unknown function of the file /api.php of the component HTTP POST Request Handler. The manipulation of the argument data[sign] leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-251556.

Affected

ProductAffectedFixed inSource

Smsot2.0–CNA

Smsot2.1–CNA

Smsot2.2–CNA

Smsot2.3–CNA

Smsot2.4–CNA

Smsot2.5–CNA

Smsot2.6–CNA

Smsot2.7–CNA

Smsot2.8–CNA

Smsot2.9–CNA

Smsot2.10–CNA

Smsot2.11–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

VulDB (CNA)6.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

VulDB (CNA)6.3CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

writeupvuldb.com/?id.251556 refvuldb.com/?ctiid.251556 exploitnote.zhaoj.in/share/3GznRo9vWRJ8