PT-2024-36638 · Ydesignservices · Yds Support Ticket System

João Pedro S Alcântara · Published 2024-12-18 · Updated 2024-12-18 · CVE-2024-55985

Positive Technologies (AI Summary)

CVSS v3.1

8.5

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

Name of the Vulnerable Software and Affected Versions ydesignservices YDS Support Ticket System versions n/a through 1.0

Description The issue is related to an SQL Injection vulnerability, allowing attackers to execute malicious SQL commands. This is due to the improper neutralization of special elements used in an SQL command.

Recommendations For versions n/a through 1.0, consider restricting access to sensitive database operations until a patch is available. As a temporary workaround, avoid using user-input data in SQL commands to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-55985

Affected Products

Yds Support Ticket System

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-55985 · Security Note
• https://twitter.com/CveFindCom/status/1869352355830841726 · Twitter Post
• https://twitter.com/CVEnew/status/1869349563611398173 · Twitter Post
• https://t.me/cvedetector/13185 · Telegram Post
• https://patchstack.com/database/wordpress/plugin/yds-support-ticket-system/vulnerability/wordpress-yds-support-ticket-system-plugin-1-0-sql-injection-vulnerability?_s_id=cve · Note
• https://patchstack.com/database/Wordpress/Plugin/yds-support-ticket-system/vulnerability/wordpress-yds-support-ticket-system-plugin-1-0-sql-injection-vulnerability?_s_id=cve · Note
• https://twitter.com/VulmonFeeds/status/1869376029120164040 · Twitter Post