PT-2024-39185 · Unknown · Shandong Star Measurement/Control Equipment Heating Network Wireless Monitoring System

Wiki + 1 · Published 2024-09-11 · Updated 2024-09-12 · CVE-2024-8705

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Shandong Star Measurement and Control Equipment Heating Network Wireless Monitoring System version 5.6.2

Description: A critical issue was found in the system, affecting the GetDataKindByType function of the file /DataSrvs/UCCGSrv.asmx. This issue leads to sql injection and can be exploited remotely. The exploit has been disclosed to the public.

Recommendations: For version 5.6.2, as a temporary workaround, consider disabling the GetDataKindByType function until a patch is available. Restrict access to the /DataSrvs/UCCGSrv.asmx file to minimize the risk of exploitation. Avoid using parameters that may lead to sql injection in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-8705

Affected Products

Shandong Star Measurement/Control Equipment Heating Network Wireless Monitoring System

References · 9

• 🔥 https://wiki.shikangsi.com/post/share/3cd1d639-7b5d-47cf-a69d-552c314b5168 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-8705 · Security Note
• https://vuldb.com/?submit.402236 · Note
• https://twitter.com/VulmonFeeds/status/1834033835110982055 · Twitter Post
• https://vuldb.com/?id.277214 · Note
• https://t.me/cvedetector/5412 · Telegram Post
• https://t.me/cvenotify/94278 · Telegram Post
• https://vuldb.com/?ctiid.277214 · Note
• https://twitter.com/CVEnew/status/1834001981410869258 · Twitter Post