Paper/Archive/CVE-2024-12364

CVE-2024-12364

Mavi Yeşil Software Guest Tracking Software — SQLi in Mavi Yeşil Software's Guest Tracking Software

CVSS 9.8 (CNA)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 37.2.372 × 207.4 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mavi Yeşil Software Guest Tracking Software allows SQL Injection. This issue affects Guest Tracking Software. NOTE: The vendor did not inform about the completion of the fixing process within the specified time. The CVE will be updated when new information becomes available.

Affected

ProductAffectedFixed inSource

Guest Tracking Softwareall versions–CNA

Scores by source

TR-CERT (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refusom.gov.tr/bildirim/tr-25-0140 refsiberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0140