PT-2025-12759 · Sirsidynix · Sirsidynix Horizon Information Portal

Published 2025-03-25 · Updated 2025-03-30 · CVE-2024-44903

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions SirsiDynix Horizon Information Portal versions through 3.25 9382

Description The issue allows SQL Injection to occur. This happens in the ipac.jsp file, specifically in a SELECT WHERE statement, and involves the uri variable within the full inner variable. A patch is available from the vendor.

Recommendations For versions through 3.25 9382, apply the patch provided by the vendor to resolve the issue. As a temporary workaround, consider restricting access to the ipac.jsp file until the patch is applied.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-44903

Affected Products

Sirsidynix Horizon Information Portal

References · 4

• 🔥 https://artresilia.com/cve-2024-44903-sql-injection-vulnerability-in-horizon-information-portal · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-44903 · Security Note
• https://twitter.com/CVEnew/status/1904427133616914648 · Twitter Post
• https://twitter.com/cracbot/status/1906300477316497537 · Twitter Post