PT-2024-24463 · Logint · Logint Lomag Inventory Management

Published 2024-05-01 · Updated 2025-09-19 · CVE-2024-32212

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LOGINT LoMag Inventory Management versions 1.0.20.120 and before

Description The issue allows an attacker to execute arbitrary code via the ArticleGetGroups, DocAddDocument, ClassClickShop, and frmSettings components. This is a SQL Injection vulnerability.

Recommendations For versions 1.0.20.120 and before, consider disabling the ArticleGetGroups, DocAddDocument, ClassClickShop, and frmSettings components until a patch is available to prevent arbitrary code execution. Restrict access to these components to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-32212

Affected Products

Logint Lomag Inventory Management

References · 8

• 🔥 https://gainsec.com/2024/04/28/cve-2024-32210-cve-2024-32211-cve-2024-32212-cve-2024-32213-lomag-integrator-ce-warehouse-management · Exploit
• https://osv.dev/vulnerability/CVE-2024-32212 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-32212 · Security Note
• https://t.me/cveNotify/135944 · Telegram Post
• https://t.me/cveNotify/135945 · Telegram Post
• https://twitter.com/CVEnew/status/1785740746957730254 · Twitter Post
• https://t.me/cveNotify/135524 · Telegram Post
• https://t.me/cveNotify/135946 · Telegram Post