PT-2025-12014 · C-News · C-News

Ceylan Bozogullarindan · Published 2025-03-20 · Updated 2025-03-25 · CVE-2024-12016

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CM News versions through 6.0

Description The issue affects CM News, allowing SQL Injection due to improper neutralization of special elements used in an SQL command. This enables attackers to execute malicious SQL commands. The vendor was contacted, and it was learned that the product is not supported.

Recommendations For CM News versions through 6.0, as a temporary workaround, consider restricting access to the SQL command functionality until a patch is available, but since the product is not supported, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-12016

Affected Products

C-News

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-12016 · Security Note
• https://twitter.com/CVEnew/status/1902625717659062364 · Twitter Post
• https://twitter.com/vulns_space/status/1902644320714514879 · Twitter Post
• https://usom.gov.tr/bildirim/tr-25-0072 · Note
• https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0072 · Note
• https://t.me/cvedetector/20704 · Telegram Post
• https://twitter.com/CveFindCom/status/1902624130890907974 · Twitter Post
• https://t.me/cvenotify/115441 · Telegram Post
• https://twitter.com/cracbot/status/1904488515377025049 · Twitter Post