PT-2025-12014 · C-News · C-News

Ceylan Bozogullarindan · Publicado 2025-03-20 · Atualizado 2025-03-25 · CVE-2024-12016

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CM News versions through 6.0

Description The issue affects CM News, allowing SQL Injection due to improper neutralization of special elements used in an SQL command. This enables attackers to execute malicious SQL commands. The vendor was contacted, and it was learned that the product is not supported.

Recommendations For CM News versions through 6.0, as a temporary workaround, consider restricting access to the SQL command functionality until a patch is available, but since the product is not supported, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2024-12016

Produtos afetados

C-News

Referências · 9

• https://twitter.com/CVEnew/status/1902625717659062364 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2024-12016 · Nota de Segurança
• https://twitter.com/vulns_space/status/1902644320714514879 · Publicação no Twitter
• https://usom.gov.tr/bildirim/tr-25-0072 · Nota
• https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0072 · Nota
• https://t.me/cvedetector/20704 · Publicação no Telegram
• https://twitter.com/CveFindCom/status/1902624130890907974 · Publicação no Twitter
• https://t.me/cvenotify/115441 · Publicação no Telegram
• https://twitter.com/cracbot/status/1904488515377025049 · Publicação no Twitter