by Kastro
Paper/Archive/CVE-2024-1576

CVE-2024-1576

Jan Syski MegaBIP — SQL Injection in MegaBIP

EPSS 0.6%CVSS 9.8
critical.is priorityof 100
39
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 47.3.473 × 209.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

SQL Injection vulnerability in MegaBIP software allows attacker to obtain site administrator privileges, including access to the administration panel and the ability to change the administrator password. This issue affects MegaBIP software versions through 5.09.

Affected

ProductAffectedFixed inSource
MegaBIP≤ 5.09–CNA
megabip≤ 5.09–CISA-ADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CERT-PL (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/AU:Y/R:I/V:D/RE:M/U:Amber
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

writeupcert.pl/en/posts/2024/06/CVE-2024-1576writeupcert.pl/posts/2024/06/CVE-2024-1576refmegabip.plrefgov.pl/web/cyfryzacja/rekomendacja-pelnomocnika-rzadu-ds-cyberbezpieczenstwa-dotyczaca-biuletynow-informacji-publicznej