PT-2024-39224 · Unknown · I-Doit Pro

Adriá Bonilla Martin + 1 · Published 2024-09-12 · Updated 2024-09-18 · CVE-2024-8749

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: idoit pro version 28

Description: The issue is a SQL injection vulnerability that could allow an attacker to send a specially crafted query to the ID parameter in /var/www/html/src/classes/modules/api/model/cmdb/isys api model cmdb objects by relation.class.php and retrieve all the information stored in the database. This vulnerability could be exploited remotely.

Recommendations: For idoit pro version 28, update the software to a version that includes a fix for this issue. As a temporary workaround, consider restricting access to the vulnerable API endpoint /var/www/html/src/classes/modules/api/model/cmdb/isys api model cmdb objects by relation.class.php to minimize the risk of exploitation. Avoid using the ID parameter in the affected API endpoint until the issue is resolved.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-8749

Affected Products

I-Doit Pro

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-8749 · Security Note
• https://osv.dev/vulnerability/CVE-2024-8749 · Vendor Advisory
• https://incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-synetics-idoit-pro · Note
• https://twitter.com/CVEnew/status/1834198148132340211 · Twitter Post
• https://t.me/cvedetector/5458 · Telegram Post
• https://twitter.com/CveFindCom/status/1834200914799870442 · Twitter Post
• https://twitter.com/oktsec/status/1834218996318490716 · Twitter Post
• https://twitter.com/cracbot/status/1835921704373428359 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1834249584903692539 · Twitter Post