PT-2024-38930 · Siempelkamp · Umweltoffice

Fidelis Abt + 1 · Published 2024-11-28 · Updated 2024-11-28 · CVE-2024-8308

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Web Application (affected versions not specified)

Description: A low privileged remote attacker can insert a SQL injection in the web application due to improper handling of HTTP request input data, which allows the exfiltration of all data. This occurs because the application does not correctly handle input data from HTTP requests.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-8308

Affected Products

Umweltoffice

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2024-8308 · Security Note
• https://twitter.com/CVEnew/status/1862087253444407637 · Twitter Post
• https://syss.de/pentest-blog/sql-injection-in-siempelkamp-nis-umweltoffice · Note
• https://twitter.com/VulmonFeeds/status/1862188617994584235 · Twitter Post