PT-2024-18144 · Megabip · Megabip

Krzysztof Gawkowski · Published 2024-06-12 · Updated 2024-08-14 · CVE-2024-1576

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MegaBIP software versions through 5.09 MegaBIP software (all versions)

Description The issue allows an attacker to obtain site administrator privileges, including access to the administration panel and the ability to change the administrator password. Additionally, it enables remote code execution, allowing the execution of arbitrary code on the server without requiring authentication by saving crafted PHP code to one of the website files.

Recommendations For MegaBIP software versions through 5.09, update to a version that addresses the SQL Injection issue. For all versions of MegaBIP software, restrict access to the administration panel and consider disabling the ability to save PHP code to website files until a patch is available. As a temporary workaround, consider implementing additional authentication measures for remote code execution to minimize the risk of exploitation.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-1576

Affected Products

Megabip

References · 13

• https://osv.dev/vulnerability/CVE-2024-1576 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-1576 · Security Note
• https://t.me/cvenotify/90517 · Telegram Post
• https://t.me/cvenotify/83007 · Telegram Post
• https://t.me/cvenotify/83005 · Telegram Post
• https://cert.pl/posts/2024/06/CVE-2024-1576 · Note
• https://t.me/cvenotify/83625 · Telegram Post
• https://cert.pl/en/posts/2024/06/CVE-2024-1576 · Note
• https://t.me/cvenotify/83006 · Telegram Post
• https://t.me/cvenotify/90516 · Telegram Post
• https://megabip.pl · Note
• https://gov.pl/web/cyfryzacja/rekomendacja-pelnomocnika-rzadu-ds-cyberbezpieczenstwa-dotyczaca-biuletynow-informacji-publicznej · Note
• https://t.me/cvenotify/90518 · Telegram Post