by Kastro
Paper/Archive/CVE-2024-26264

CVE-2024-26264

EBM Technologies RISWEB — EBM Technologies RISWEB - SQL Injection

EPSS 0.8%CVSS 9.8
critical.is priorityof 100
41
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 58.1.581 × 2011.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

EBM Technologies RISWEB's specific query function parameter does not properly restrict user input, and this feature page is accessible without login. This allows remote attackers to inject SQL commands without authentication, enabling them to read, modify, and delete database records.

Affected

ProductAffectedFixed inSource
RISWEB1.x–CNA
RISWEB2.x–CNA
risweb1.x–CISA-ADP
risweb2.x–CISA-ADP

Scores by source

twcert (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

writeuptwcert.org.tw/tw/cp-132-7677-b1c0f-1.html