by Kastro
Paper/Archive/CVE-2024-48509

CVE-2024-48509

learning_with_texts learning_with_texts — Learning with Texts (LWT) 2.0.3 is vulnerable to SQL Injection.

EPSS 0.5%CVSS 9.8
critical.is priorityof 100
39
CVSS 9.8 (ADP, NVD agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 45.6.456 × 209.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Learning with Texts (LWT) 2.0.3 is vulnerable to SQL Injection. This occurs when the application fails to properly sanitize user inputs, allowing attackers to manipulate SQL queries by injecting malicious SQL statements into URL parameters. By exploiting this vulnerability, an attacker could gain unauthorized access to the database, retrieve sensitive information, modify or delete data, and execute arbitrary commands.

Affected

ProductAffectedFixed inSource
n/an/a–CNA
learning_with_texts2.0.3–CISA-ADP

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refmedium.com/%40ChadSecurity/the-cve-2024-48509-vulnerability-overview-df58a6be6864