PT-2024-21803 · Unknown · Postgresql+1

Mikhail Shcherbakov · Published 2024-03-01 · Updated 2025-12-03 · CVE-2024-27298

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions parse-server versions prior to 6.5.0 parse-server versions prior to 7.0.0-alpha.20

Description This issue allows SQL injection when parse-server is configured to use the PostgreSQL database. A remote attacker could send specially-crafted SQL statements to view, add, modify or delete information in the back-end database.

Recommendations For versions prior to 6.5.0, update to version 6.5.0 or later. For versions prior to 7.0.0-alpha.20, update to version 7.0.0-alpha.20 or later. As a temporary workaround, consider restricting access to the PostgreSQL database until a patch is applied.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BIT-PARSE-2024-27298

CVE-2024-27298

GHSA-6927-3VR9-FXF2

ZDI-24-900

Affected Products

Postgresql

Parse Server

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/27xxx/CVE-2024-27298.json · Exploit
• https://github.com/parse-community/parse-server/commit/cbefe770a7260b54748a058b8a7389937dc35833 · Patch
• https://github.com/parse-community/parse-server/security/advisories/GHSA-6927-3vr9-fxf2 · Vendor Advisory
• https://github.com/parse-community/parse-server/commit/a6e654943536932904a69b51e513507fcf90a504 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-27298 · Security Note
• https://osv.dev/vulnerability/BIT-parse-2024-27298 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-24-900 · Security Note
• https://osv.dev/vulnerability/CVE-2024-27298 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6927-3vr9-fxf2 · Vendor Advisory
• https://github.com/parse-community/parse-server · Note
• https://github.com/parse-community/parse-server/releases/tag/7.0.0-alpha.20 · Note
• https://github.com/parse-community/parse-server/releases/tag/6.5.0 · Note
• https://t.me/cveNotify/144655 · Telegram Post
• https://twitter.com/CCBalert/status/1765743924109279407 · Twitter Post
• https://twitter.com/cracbot/status/1764024200124068278 · Twitter Post