PT-2025-7776 · Unknown+1 · Xone Web Monitor+1

Javier Carabantes · Published 2025-02-24 · Updated 2025-04-09 · CVE-2024-54820

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions XOne Web Monitor version 02.10.2024.530 XOne Web Monitor framework version 1.0.4.9

Description The issue is a SQL injection vulnerability located in the login page, allowing attackers to extract all usernames and passwords via a crafted input.

Recommendations For XOne Web Monitor version 02.10.2024.530, consider disabling the login page functionality until a patch is available. For XOne Web Monitor framework version 1.0.4.9, restrict access to the login page to minimize the risk of exploitation. Avoid using the login page with crafted inputs until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-54820

Affected Products

Xone Web Monitor

Framework

References · 9

• 🔥 https://github.com/jcarabantes/CVE-2024-54820 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-54820 · Security Note
• https://t.me/cvedetector/18817 · Telegram Post
• https://twitter.com/ExCraft_labs/status/1909950999935975493 · Twitter Post
• https://twitter.com/taqtics_ai/status/1896531017025851820 · Twitter Post
• https://t.me/thedarkwebinformer/13259 · Telegram Post
• https://twitter.com/DarkWebInformer/status/1894103458711589276 · Twitter Post
• https://xone.es · Note
• https://twitter.com/CVEnew/status/1894082479926988806 · Twitter Post