PT-2024-27176 · Unknown · Boelter Blue System Management

Deadlydata + 1 · Published 2024-06-12 · Updated 2024-07-03 · CVE-2024-36840

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Boelter Blue System Management version 1.3

Description The issue allows a remote attacker to execute arbitrary code and obtain sensitive information. This is achieved via the id parameter to "news details.php" and "location details.php", and the section parameter to "services.php".

Recommendations For Boelter Blue System Management version 1.3, avoid using the id parameter in the "news details.php" and "location details.php" API endpoints, and the section parameter in the "services.php" endpoint until the issue is resolved. Consider restricting access to these endpoints to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-36840

Affected Products

Boelter Blue System Management

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-36840 · Security Note
• https://play.google.com/store/apps/details?id=com.anchor5digital.anchor5adminapp&hl=en_US · Note
• https://sploitus.com/exploit?id=PACKETSTORM:178978 · Note
• https://infosec-db.github.io/CyberDepot/vuln_boelter_blue · Note
• http://seclists.org/fulldisclosure/2024/Jun/0 · Note
• https://vuldb.com/?id.267594 · Note
• https://packetstormsecurity.com/files/178978/Boelter-Blue-System-Management-1.3-SQL-Injection.html · Note