PT-2024-38842 · Unknown · Continew Admin

Chiexf · Published 2024-08-25 · Updated 2024-09-12 · CVE-2024-8155

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:L/Au:M/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: ContiNew Admin version 3.2.0

Description: A critical vulnerability was found in ContiNew Admin, affecting the function top.continew.starter.extension.crud.controller.BaseController#tree of the file "/api/system/dept/tree?sort=parentId%2Casc&sort=sort%2Casc". The manipulation of the sort argument leads to SQL injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Recommendations: For ContiNew Admin version 3.2.0, upgrade to version 3.2.1 immediately to mitigate risks. As a temporary workaround, consider restricting access to the vulnerable API endpoint "/api/system/dept/tree" until the issue is resolved. Avoid using the sort argument in the affected API endpoint until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-8155

Affected Products

Continew Admin

References · 14

• 🔥 https://github.com/Chiexf/cve/issues/3 · Exploit
• https://osv.dev/vulnerability/CVE-2024-8155 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-8155 · Security Note
• https://twitter.com/VulmonFeeds/status/1827867958833500369 · Twitter Post
• https://twitter.com/CVEnew/status/1827850599951478837 · Twitter Post
• https://twitter.com/transilienceai/status/1829198715162095974 · Twitter Post
• https://twitter.com/transilienceai/status/1829198700171677745 · Twitter Post
• https://vuldb.com/?id.275743 · Note
• https://vuldb.com/?submit.391851 · Note
• https://t.me/cvedetector/4094 · Telegram Post
• https://vuldb.com/?ctiid.275743 · Note
• https://t.me/cvenotify/92088 · Telegram Post
• https://twitter.com/transilienceai/status/1829198721805897913 · Twitter Post
• https://twitter.com/transilienceai/status/1829198708048581112 · Twitter Post