by Kastro
Paper/Archive/CVE-2024-12150

CVE-2024-12150

Eron Software Wowwo CRM — SQLi in Eron Software's Wowwo CRM

EPSS 0.4%CVSS 9.8
critical.is priorityof 100
36
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 34.3.343 × 206.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eron Software Wowwo CRM allows Blind SQL Injection. This issue affects Wowwo CRM.  NOTE: The vendor did not inform about the completion of the fixing process within the specified time. The CVE will be updated when new information becomes available.

Affected

ProductAffectedFixed inSource
Wowwo CRMall versions–CNA

Scores by source

TR-CERT (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refusom.gov.tr/bildirim/tr-25-0141refsiberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0141