by Kastro
Paper/Archive/CVE-2024-6160

CVE-2024-6160

Jan Syski MegaBIP — SQL Injection in MegaBIP

EPSS 0.5%CVSS 9.3
critical.is priorityof 100
36
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 40.6.406 × 208.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

SQL Injection vulnerability in MegaBIP software allows attacker to disclose the contents of the database, obtain session cookies or modify the content of pages. This issue affects MegaBIP software versions through 5.12.1.

Affected

ProductAffectedFixed inSource
MegaBIP≤ 5.12.1–CNA
megabip≤ 5.12.1–CISA-ADP

Scores by source

CERT-PL (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/AU:Y/R:I/V:D/RE:M/U:Amber
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

writeupcert.pl/en/posts/2024/06/CVE-2024-6160writeupcert.pl/posts/2024/06/CVE-2024-6160refmegabip.plrefgov.pl/web/cyfryzacja/rekomendacja-pelnomocnika-rzadu-ds-cyberbezpieczenstwa-dotyczaca-biuletynow-informacji-publicznej