PT-2025-9017 · Gfast · Gfast

Superdu1 · Published 2025-02-27 · Updated 2025-03-03 · CVE-2024-55160

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GFast versions v2 through v3.2

Description A SQL injection issue was found via the OrderBy parameter at the "/system/operLog/list" API endpoint.

Recommendations For GFast versions v2 through v3.2, avoid using the OrderBy parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-55160

Affected Products

Gfast

References · 11

• 🔥 https://github.com/SuperDu1/CVE/issues/2 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-55160 · Security Note
• https://osv.dev/vulnerability/CVE-2024-55160 · Vendor Advisory
• https://github.com/tiger1103/gfast/blob/os-v3.2/api/v1/system/sys_oper_log.go#L35 · Note
• https://github.com/tiger1103/gfast/tree/os-v3.2 · Note
• https://github.com/tiger1103/gfast/blob/os-v3.2/internal/app/system/logic/sysOperLog/sys_oper_log.go#L121 · Note
• https://t.me/cvenotify/113155 · Telegram Post
• https://twitter.com/cybercronai/status/1895829006064161151 · Twitter Post
• https://twitter.com/CVEnew/status/1895622670626050420 · Twitter Post
• https://t.me/cvedetector/19074 · Telegram Post
• http://gfast.com · Note