Paper/Archive/CVE-2024-0857

CVE-2024-0857

Universal Software Inc. FlexWater Corporate Water Management — SQLi in Universal Software's FlexWater Corporate Water Management

EPSS 0.4%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (CNA)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 36.5.365 × 207.3 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Universal Software Inc. FlexWater Corporate Water Management allows SQL Injection. This issue affects FlexWater Corporate Water Management: before 5.452.0.

Affected

ProductAffectedFixed inSource

FlexWater Corporate Water Management< 5.452.05.452.0CNA

flexwater_corporate_water_management< 5.452.05.452.0CISA-ADP

Scores by source

TR-CERT (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refusom.gov.tr/bildirim/tr-24-1011 refsiberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-24-1011