PT-2024-20286 · Atmail · Atmail

Hebing123 · Published 2024-02-07 · Updated 2024-08-22 · CVE-2024-24133

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Atmail version 6.6.0

Description The issue is a SQL injection vulnerability that can be exploited via the username parameter on the login page.

Recommendations For Atmail version 6.6.0, avoid using the username parameter in the login page until the issue is resolved. As a temporary workaround, consider restricting access to the login page to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-24133

Affected Products

Atmail

References · 8

• 🔥 https://github.com/Hebing123/cve/issues/16 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-24133 · Security Note
• https://osv.dev/vulnerability/CVE-2024-24133 · Vendor Advisory
• https://t.me/cvenotify/70377 · Telegram Post
• https://t.me/cvenotify/88384 · Telegram Post
• https://t.me/cvenotify/91797 · Telegram Post
• https://t.me/cvenotify/70406 · Telegram Post
• https://twitter.com/CVEnew/status/1755236923327832162 · Twitter Post