by Kastro
Paper/Archive/CVE-2024-1100

CVE-2024-1100

Vadi Corporate Information Systems DIGIKENT GIS — SQLi in Vadi Corporate Information Systems' DIGIKENT GIS

EPSS 0.4%CVSS 10.0
critical.is priorityof 100
37
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 36.4.364 × 207.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Vadi Corporate Information Systems DIGIKENT GIS allows SQL Injection. This issue affects DIGIKENT GIS: through 2.23.5.

Affected

ProductAffectedFixed inSource
DIGIKENT GIS≤ 2.23.5–CNA
digikent_gis≤ 2.23.5–CISA-ADP

Scores by source

TR-CERT (CNA)10.0CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refusom.gov.tr/bildirim/tr-24-0589refsiberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-24-0589