PT-2024-9403 · Siemens · Syngo.Plaza

Bernhard Lorenz

+1

·

Published

2024-12-06

·

Updated

2024-12-11

·

CVE-2024-52335

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions: syngo.plaza VB30E versions prior to VB30E HF05
Description: The issue is related to the lack of protection of the SQL query structure, allowing an attacker to execute arbitrary SQL code and compromise the database. The affected application does not properly sanitize input data before sending it to the SQL server. This could allow an attacker with access to the application to use this vulnerability to execute malicious SQL commands and compromise the whole database.
Recommendations: For syngo.plaza VB30E versions prior to VB30E HF05, update to VB30E HF05 or later to resolve the issue. As a temporary workaround, consider restricting access to the SQL server to minimize the risk of exploitation. Avoid using unsanitized input data in SQL queries until the issue is resolved.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2024-11096
CVE-2024-52335

Affected Products

Syngo.Plaza