PT-2024-36561 · Nette · Nette Database

Published 2024-12-10 · Updated 2024-12-12 · CVE-2024-55586

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Nette Database versions 3.2.4 and earlier

Description The issue allows SQL injection in certain situations involving an untrusted filter that is directly passed to the where method. This occurs when there's an untrusted filter sent straight to the where method. The vendor's position is that this is intended behavior.

Recommendations For versions 3.2.4 and earlier, as a temporary workaround, consider restricting the use of untrusted filters that are directly passed to the where method until a resolution is provided. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-55586

GHSA-F626-677R-J5VQ

Affected Products

Nette Database

References · 11

• 🔥 https://github.com/CSIRTTrizna/CVE-2024-55586 · Exploit
• https://osv.dev/vulnerability/CVE-2024-55586 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-55586 · Security Note
• https://osv.dev/vulnerability/GHSA-f626-677r-j5vq · Vendor Advisory
• https://github.com/github/advisory-database/pull/5079#issuecomment-2552932977 · Note
• https://github.com/nette/database/releases · Note
• https://github.com/nette/database · Note
• https://t.me/cvenotify/103964 · Telegram Post
• https://csirt.sk/nette-framework-vulnerability-permits-sql-injection.html · Note
• https://t.me/cvedetector/12499 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1866510040368062941 · Twitter Post