PT-2024-33061 · Cloudlog · Cloudlog

Published 2024-10-14 · Updated 2025-05-02 · CVE-2024-48259

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Cloudlog version 2.6.15

Description The issue concerns an SQL injection vulnerability in Cloudlog's Oqrs.php request form, which can be exploited via the station id or callsign variables. This vulnerability allows attackers to manipulate the SQL queries, potentially leading to unauthorized access or data modification. The estimated number of potentially affected devices and real-world incidents are not specified.

Recommendations For Cloudlog version 2.6.15, consider disabling the Oqrs.php request form or restricting access to it until a patch is available. Avoid using the station id and callsign variables in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-48259

Affected Products

Cloudlog

References · 11

• 🔥 https://chiggerlor.substack.com/p/unauthenticated-sql-injection-in-9a3 · Exploit
• https://osv.dev/vulnerability/CVE-2024-48259 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-48259 · Security Note
• https://github.com/magicbug/Cloudlog · Note
• https://twitter.com/cracbot/status/1846793369433030824 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1845876352253047036 · Twitter Post
• https://magicbug.co.uk/cloudlog · Note
• https://twitter.com/cracbot/status/1847518107319058433 · Twitter Post
• https://t.me/cvedetector/7813 · Telegram Post
• https://twitter.com/CVEnew/status/1845830978129793458 · Twitter Post
• https://t.me/cvenotify/120687 · Telegram Post