PT-2024-5175 · Unknown · Tailoring Management System

Jiaoyanshuai · Published 2024-07-14 · Updated 2024-08-21 · CVE-2024-6734

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Tailoring Management System version 1.0

Description: The issue is related to a lack of protection against SQL query structure exploitation in the templateadd.php file. This allows a remote attacker to execute arbitrary SQL code, gain unauthorized access to read, modify, or delete data, or cause a denial of service by sending specially crafted requests with the title and msg parameters. The manipulation of the title and msg arguments leads to SQL injection. The attack can be initiated remotely.

Recommendations: For Tailoring Management System version 1.0, consider disabling the templateadd.php file or restricting access to it until a patch is available. As a temporary workaround, avoid using the title and msg parameters in the affected API endpoint until the issue is resolved. Restrict access to the templateadd.php file to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2024-05731

CVE-2024-6734

Affected Products

Tailoring Management System

References · 10

• 🔥 https://github.com/jiaoyanshuai/cve/issues/2 · Exploit
• https://osv.dev/vulnerability/CVE-2024-6734 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-6734 · Security Note
• https://bdu.fstec.ru/vul/2024-05731 · Security Note
• https://vuldb.com/?id.271455 · Note
• https://vuldb.com/?ctiid.271455 · Note
• https://t.me/cvedetector/824 · Telegram Post
• https://vuldb.com/ru/?id.271455 · Note
• https://t.me/cvenotify/86160 · Telegram Post
• https://vuldb.com/?submit.374464 · Note