by Kastro
Paper/Archive/CVE-2024-9982

CVE-2024-9982

ESi Technology AIM LINE Marketing Platform — ESi Technology AIM LINE Marketing Platform - SQL Injection

EPSS 0.7%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 52.3.523 × 2010.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

AIM LINE Marketing Platform from Esi Technology does not properly validate a specific query parameter. When the LINE Campaign Module is enabled, unauthenticated remote attackers can inject arbitrary FetchXml commands to read, modify, and delete database content.

Affected

ProductAffectedFixed inSource
AIM LINE Marketing Platform3.3 – 5.8.4–CNA
aim_line_marketing_platform3.3 – 5.8.4–CISA-ADP

Scores by source

twcert (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

writeuptwcert.org.tw/tw/cp-132-8146-497a2-1.htmlwriteuptwcert.org.tw/en/cp-139-8147-eb650-2.html