PT-2024-36248 · Unknown · Outstrip Instant Appointment
Lvt-Tholv2K
·
Published
2024-12-16
·
Updated
2024-12-16
·
CVE-2024-54361
CVSS v3.1
9.3
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L |
Name of the Vulnerable Software and Affected Versions:
Outstrip Instant Appointment versions n/a through 1.2
Description:
The issue is related to the improper neutralization of special elements used in an SQL command, which allows for SQL injection. This can be exploited through API endpoints, although specific endpoints are not mentioned. Vulnerable parameters or variables, such as
username or password, are not explicitly specified. The issue does not mention specific function names, such as checkPassword() or processTransaction(), that are vulnerable. There is no information provided about the estimated number of potentially affected devices worldwide or details about real-world incidents where this issue was exploited.Recommendations:
For versions n/a through 1.2, update to a version that includes a fix for this issue, although the specific fixed version is not provided. As a temporary workaround, consider restricting access to SQL commands or disabling any features that may be using SQL commands until a patch is available. Avoid using user-inputted data in SQL commands until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
SQL injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Outstrip Instant Appointment