Paper/Archive/CVE-2024-44349

CVE-2024-44349

anteeowms anteeowms — A SQL injection vulnerability in login portal in AnteeoWMS before v4.7.34 allows unauthenticated attackers to execute arbitrary SQL comma…

EPSS 6%public exploit CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (ADP)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 93.1.931 × 2018.6 Exploit: SSVC poc+1010.0 SSVC exploitation: poc+100.0

Description · from the CVE record

A SQL injection vulnerability in login portal in AnteeoWMS before v4.7.34 allows unauthenticated attackers to execute arbitrary SQL commands via the username parameter and disclosure of some data in the underlying DB.

Affected

ProductAffectedFixed inSource

n/an/a–CNA

anteeowms< 4.7.344.7.34CISA-ADP

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refcybergon.com refblog.cybergon.com/posts/cve-2024-44349 refgithub.com/AndreaF17/PoC-CVE-2024-44349