PT-2024-39692 · Sovell · Sovell Smart Canteen System

Qieziwa · Published 2024-10-06 · Updated 2024-10-07 · CVE-2024-9554

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Sovell Smart Canteen System versions up to 3.0.7303.30513

Description A vulnerability was found in the Sovell Smart Canteen System, affecting the function Check ET CheckPwdz201 of the file suanfa.py, which is part of the Password Reset Handler component. This issue leads to authorization bypass and can be exploited remotely, although the complexity of the attack is considered high and the exploitation appears to be difficult.

Recommendations For versions up to 3.0.7303.30513, as a temporary workaround, consider disabling the Check ET CheckPwdz201 function until a patch is available. Restrict access to the Password Reset Handler component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2024-9554

Affected Products

Sovell Smart Canteen System

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-9554 · Security Note
• https://t.me/cvedetector/7146 · Telegram Post
• ❌ https://github.com/qieziwa/Code_vulnerability/blob/main/%E9%9B%84%E4%BC%9F-%E9%A4%90%E5%8E%85%E6%95%B0%E5%AD%97%E5%8C%96%E4%BB%BB%E6%84%8F%E5%AF%86%E7%A0%81%E9%87%8D%E7%BD%AE.md · Note, Deleted
• https://twitter.com/VulmonFeeds/status/1842999678863843832 · Twitter Post
• https://vuldb.com/?submit.412954 · Note
• https://twitter.com/CVEnew/status/1842892191125172275 · Twitter Post
• https://vuldb.com/?id.279361 · Note
• https://vuldb.com/?ctiid.279361 · Note