by Kastro
Paper/Archive/CVE-2024-7076

CVE-2024-7076

Semtek Informatics Software Consulting Inc. Semtek Sempos — SQLi in Semtek Informatics Software's Semtek Sempos

EPSS 0.5%CVSS 9.8
critical.is priorityof 100
38
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 40.3.403 × 208.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Semtek Informatics Software Consulting Inc. Semtek Sempos allows Blind SQL Injection. This issue affects Semtek Sempos: through 31072024.

Affected

ProductAffectedFixed inSource
Semtek Sempos≤ 31072024–CNA
sempos≤ 31072024–CISA-ADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
TR-CERT (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/AU:Y/R:U/V:C/RE:L
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refusom.gov.tr/bildirim/tr-24-1396refsiberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-24-1396