PT-2025-7776 · Unknown+1 · Xone Web Monitor+1

Javier Carabantes · Publicado 2025-02-24 · Atualizado 2025-04-09 · CVE-2024-54820

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions XOne Web Monitor version 02.10.2024.530 XOne Web Monitor framework version 1.0.4.9

Description The issue is a SQL injection vulnerability located in the login page, allowing attackers to extract all usernames and passwords via a crafted input.

Recommendations For XOne Web Monitor version 02.10.2024.530, consider disabling the login page functionality until a patch is available. For XOne Web Monitor framework version 1.0.4.9, restrict access to the login page to minimize the risk of exploitation. Avoid using the login page with crafted inputs until the issue is resolved.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2024-54820

Produtos afetados

Xone Web Monitor

Framework

Referências · 9

• 🔥 https://github.com/jcarabantes/CVE-2024-54820 · Exploit
• https://t.me/cvedetector/18817 · Publicação no Telegram
• https://twitter.com/ExCraft_labs/status/1909950999935975493 · Publicação no Twitter
• https://twitter.com/taqtics_ai/status/1896531017025851820 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2024-54820 · Nota de Segurança
• https://t.me/thedarkwebinformer/13259 · Publicação no Telegram
• https://twitter.com/DarkWebInformer/status/1894103458711589276 · Publicação no Twitter
• https://xone.es · Nota
• https://twitter.com/CVEnew/status/1894082479926988806 · Publicação no Twitter