PT-2024-33170 · Sage · Sage 1000

Published 2024-10-30 · Updated 2025-06-27 · CVE-2024-48647

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sage 1000 version 7.0.0

Description A file disclosure issue exists, allowing remote attackers to retrieve arbitrary files from the server's file system by manipulating the URL parameter in HTTP requests. This could lead to access of sensitive information, including configuration files that may contain credentials and system settings, potentially compromising the server further.

Recommendations For Sage 1000 version 7.0.0, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Files Accessible to External Parties

Weakness Enumeration

CWE-552

Related Identifiers

CVE-2024-48647

Affected Products

Sage 1000

References · 5

• 🔥 https://github.com/hx381/Sage-1000-v7.0.0-Exploit/blob/main/README.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-48647 · Security Note
• https://osv.dev/vulnerability/CVE-2024-48647 · Vendor Advisory
• https://t.me/cvedetector/9450 · Telegram Post
• https://t.me/cvenotify/126948 · Telegram Post