Paper/Archive/CVE-2024-6527

CVE-2024-6527

Jan Syski MegaBIP — SQL Injection in MegaBIP

CVSS 9.3 (CNA)9.3 / 10 × 3027.9 Not in CISA KEV+300.0 EPSS percentile 48.6.486 × 209.7 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

SQL Injection vulnerability in parameter "w" in file "druk.php" in MegaBIP software allows unauthorized attacker to disclose the contents of the database and obtain administrator's token to modify the content of pages. This issue affects MegaBIP software versions through 5.13.

Affected

ProductAffectedFixed inSource

MegaBIP≤ 5.13–CNA

megabip≤ 5.13–CISA-ADP

Scores by source

CERT-PL (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/AU:Y/R:I/V:D/RE:M/U:Amber

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

writeupcert.pl/en/posts/2024/07/CVE-2024-6527 writeupcert.pl/posts/2024/07/CVE-2024-6527 refmegabip.pl refgov.pl/web/cyfryzacja/rekomendacja-pelnomocnika-rzadu-ds-cyberbezpieczenstwa-dotyczaca-biuletynow-informacji-publicznej