PT-2025-3401 · Moss · Moss

Refengso · Published 2025-02-03 · Updated 2025-10-02 · CVE-2024-57098

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Moss version v0.1.3

Description The issue is related to an SQL injection vulnerability that allows attackers to inject carefully designed payloads into the order parameter. This vulnerability can be exploited by injecting malicious input into the affected parameter.

Recommendations For Moss version v0.1.3, as a temporary workaround, consider restricting access to the order parameter to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-57098

Affected Products

Moss

References · 7

• 🔥 https://github.com/deep-project/moss/issues/13 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-57098 · Security Note
• https://osv.dev/vulnerability/CVE-2024-57098 · Vendor Advisory
• https://t.me/cvedetector/17105 · Telegram Post
• https://t.me/cveNotify/137228 · Telegram Post
• https://twitter.com/CVEnew/status/1886523337981223059 · Twitter Post
• https://twitter.com/CVETracker/status/1886867509715898656 · Twitter Post