Paper/Archive/CVE-2024-13151

CVE-2024-13151

ESBI Information and Telecommunication Industry and Trade Limited Company Auto Service Software — SQLi in ESBI Informatics's Auto Service Software

EPSS 0.4%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (CNA)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 29.0.290 × 205.8 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

CWE - 89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ESBI Information and Telecommunication Industry and Trade Limited Company Auto Service Software allows SQL Injection. This issue affects Auto Service Software: before v.2025.10.01.

Affected

ProductAffectedFixed inSource

Auto Service Software< v.2025.10.01v.2025.10.01CNA

Scores by source

TR-CERT (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refusom.gov.tr/bildirim/tr-25-0273 refsiberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0273