PT-2024-27088 · Unknown · Aegon Life

Aslam Anwar Mahimkar · Published 2024-06-13 · Updated 2026-02-06 · CVE-2024-36597

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Aegon Life version 1.0

Description The issue is a SQL injection vulnerability. It can be exploited via the client id parameter at the "clientStatus.php" endpoint.

Recommendations For Aegon Life version 1.0, as a temporary workaround, consider restricting access to the "clientStatus.php" endpoint until a patch is available. Avoid using the client id parameter in the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-36597

Affected Products

Aegon Life

References · 9

• 🔥 https://github.com/kaliankhe/CVE-Aslam-mahi/blob/9ec0572c68bfd3708a7d6e089181024131f4e927/vendors/projectworlds.in/AEGON%20LIFE%20v1.0%20Life%20Insurance%20Management%20System/CVE-2024-36597 · Exploit
• https://osv.dev/vulnerability/CVE-2024-36597 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-36597 · Security Note
• https://t.me/cveNotify/151140 · Telegram Post
• https://exploit-db.com/exploits/52046 · Note
• https://twitter.com/VulmonFeeds/status/1801400372868608474 · Twitter Post
• https://twitter.com/CVEnew/status/1801673824834097316 · Twitter Post
• https://t.me/cvenotify/89967 · Telegram Post
• https://t.me/cvenotify/83317 · Telegram Post