PT-2024-23673 · Derbynet · Derbynet

Chocapikk + 1 · Published 2024-04-05 · Updated 2024-08-08 · CVE-2024-30923

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions DerbyNet versions 9.0 and below

Description The issue allows a remote attacker to execute arbitrary code via the where Clause in Racer Document Rendering. This is a SQL Injection vulnerability.

Recommendations For DerbyNet versions 9.0 and below, consider disabling the where Clause in Racer Document Rendering until a patch is available. Restrict access to the Racer Document Rendering module to minimize the risk of exploitation. Avoid using the where Clause in the affected rendering process until the issue is resolved.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2024-30923

Affected Products

Derbynet

References · 10

• 🔥 https://chocapikk.com/posts/2024/derbynet-vulnerabilities · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-30923 · Security Note
• https://osv.dev/vulnerability/CVE-2024-30923 · Vendor Advisory
• https://t.me/cvenotify/77360 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1781088681639448607 · Twitter Post
• https://t.me/cvenotify/77420 · Telegram Post
• http://seclists.org/fulldisclosure/2024/Apr/9 · Note
• https://twitter.com/buaqbot/status/1776306383672996247 · Twitter Post
• https://t.me/cvenotify/89974 · Telegram Post
• https://twitter.com/CVEnew/status/1781102377439010880 · Twitter Post