PT-2024-37691 · Megabip · Megabip

Krzysztof Gawkowski · Published 2024-07-09 · Updated 2024-07-10 · CVE-2024-6527

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:I/V:D/RE:M/U:Amber

Name of the Vulnerable Software and Affected Versions MegaBIP software versions through 5.13

Description The issue allows an unauthorized attacker to disclose the contents of the database and obtain the administrator's token to modify the content of pages due to a SQL Injection vulnerability in the parameter w in the file "druk.php".

Recommendations For MegaBIP software versions through 5.13, upgrade to version 5.13.1 to resolve the issue. As a temporary workaround, consider restricting access to the "druk.php" file or disabling the parameter w to minimize the risk of exploitation.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-6527

Affected Products

Megabip

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-6527 · Security Note
• https://cert.pl/en/posts/2024/07/CVE-2024-6527 · Note
• https://t.me/cvenotify/85532 · Telegram Post
• https://twitter.com/CVEnew/status/1810672991836971293 · Twitter Post
• https://twitter.com/CveFindCom/status/1810675437414080982 · Twitter Post
• https://cert.pl/posts/2024/07/CVE-2024-6527 · Note
• https://megabip.pl · Note
• https://gov.pl/web/cyfryzacja/rekomendacja-pelnomocnika-rzadu-ds-cyberbezpieczenstwa-dotyczaca-biuletynow-informacji-publicznej · Note
• https://twitter.com/CCBalert/status/1811057090732921292 · Twitter Post