PT-2024-17781 · Unknown · Treasurehuntgame Treasurehunt

Jotaespig · Published 2024-12-22 · Updated 2025-01-10 · CVE-2024-12894

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TreasureHuntGame TreasureHunt up to 963e0e0

Description A critical issue was found in TreasureHuntGame TreasureHunt, affecting an unknown function of the file TreasureHunt/acesso.php. The manipulation of the usuario argument leads to SQL injection. It is possible to launch the attack remotely. This product uses a rolling release for continuous delivery, and therefore, no version details for affected or updated releases are available.

Recommendations To fix this issue, it is recommended to apply a patch. Specifically, the patch named 8bcc649abc35b7734951be084bb522a532faac4e should be applied. As a temporary workaround, consider restricting access to the vulnerable function in the TreasureHunt/acesso.php file until the patch is applied. Additionally, avoid using the usuario argument in the affected file to minimize the risk of exploitation.

Fix

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-74

CWE-89

Related Identifiers

CVE-2024-12894

Affected Products

Treasurehuntgame Treasurehunt

References · 9

• https://github.com/TreasureHuntGame/TreasureHunt/commit/8bcc649abc35b7734951be084bb522a532faac4e · Patch
• https://osv.dev/vulnerability/CVE-2024-12894 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-12894 · Security Note
• https://vuldb.com/?id.289164 · Note
• https://t.me/cvenotify/105252 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1870813408565587973 · Twitter Post
• https://vuldb.com/?ctiid.289164 · Note
• https://t.me/cvedetector/13511 · Telegram Post
• https://twitter.com/CVEnew/status/1870815215492673932 · Twitter Post