PT-2024-31136 · Anteeowms · Anteeowms

Andrea Ferrario + 1 · Published 2024-10-07 · Updated 2024-10-13 · CVE-2024-44349

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AnteeoWMS versions prior to 4.7.34

Description A SQL injection issue in the login portal allows unauthenticated attackers to execute arbitrary SQL commands via the username parameter, potentially leading to the disclosure of some data in the underlying database.

Recommendations For versions prior to 4.7.34, update to version 4.7.34 or later to resolve the issue. As a temporary workaround, consider restricting access to the login portal or validating and sanitizing the username parameter to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-44349

Affected Products

Anteeowms

References · 9

• 🔥 https://github.com/AndreaF17/PoC-CVE-2024-44349 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-44349 · Security Note
• https://cybergon.com · Note
• https://t.me/cvenotify/97754 · Telegram Post
• https://twitter.com/cracbot/status/1845343831732154738 · Twitter Post
• https://twitter.com/CVEnew/status/1843697042754875510 · Twitter Post
• https://blog.cybergon.com/posts/cve-2024-44349 · Note
• https://twitter.com/VulmonFeeds/status/1843298644616753489 · Twitter Post
• https://t.me/cvedetector/7389 · Telegram Post