PT-2024-31827 · Baltic It · Baltic-It Topqw Webportal

Majid Lakhnati + 1 · Published 2024-11-13 · Updated 2024-11-15 · CVE-2024-45875

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions baltic-it TOPqw Webportal versions 1.35.287.1 through 1.35.290

Description The create user function in the baltic-it TOPqw Webportal is vulnerable to SQL injection. This issue affects the /Apps/TOPqw/BenutzerManagement.aspx/SaveNewUser endpoint, where the username variable in the JSON object allows the manipulation of SQL queries.

Recommendations For versions 1.35.287.1 through 1.35.290, update to version 1.35.291 to resolve the issue. As a temporary workaround, consider restricting access to the /Apps/TOPqw/BenutzerManagement.aspx/SaveNewUser endpoint until the update is applied.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-45875

Affected Products

Baltic-It Topqw Webportal

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2024-45875 · Security Note
• https://cyber.wtf/2024/11/11/topqw-webportal-cves · Note
• https://twitter.com/VulmonFeeds/status/1857030916461171108 · Twitter Post
• https://twitter.com/CVEnew/status/1856828050664747202 · Twitter Post
• https://t.me/cvedetector/10884 · Telegram Post