by Kastro
Paper/Archive/CVE-2024-3704

CVE-2024-3704

OpenGnsys OpenGnsys — SQL Injection vulnerability in OpenGnsys

EPSS 0.7%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 54.3.542 × 2010.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

SQL Injection Vulnerability has been found on OpenGnsys product affecting version 1.1.1d (Espeto). This vulnerability allows an attacker to inject malicious SQL code into login page to bypass it or even retrieve all the information stored in the database.

Affected

ProductAffectedFixed inSource
OpenGnsys1.1.1d–CNA
opengnsys1.1.1d–CISA-ADP

Scores by source

INCIBE (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refincibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-opengnsyspatchopengnsys.es/web/parche-de-seguridad-cve-2024-370x