PT-2024-19588 · Unknown · Axe Credit Portal

4Rth4S · Published 2024-04-22 · Updated 2024-11-22 · CVE-2024-22856

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Axe Credit Portal versions 3.0 and later

Description The issue allows authenticated attackers to execute unintended queries and disclose sensitive information from database tables via crafted requests, specifically through the Save Favorite Search function.

Recommendations For Axe Credit Portal versions 3.0 and later, update to a version that includes a fix for this issue to prevent exploitation.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-22856

Affected Products

Axe Credit Portal

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2024-22856 · Security Note
• https://4rth4s.xyz/2024/04/cve-2024-22856-authenticated-blind-sql.html · Note