CVE-2024-29824
CVE-2024-29824
In short
A flaw in Ivanti EPM 2022 SU5 allows an attacker on the same network to inject malicious SQL commands without logging in, leading to arbitrary code execution on the server.
Technical detail
An unauthenticated SQL injection vulnerability (CWE-89) in the Core server component permits network-adjacent attackers to execute arbitrary SQL queries, which can be leveraged to achieve remote code execution. Pre-condition: attacker must be on the same network segment; impact includes full server compromise.
Summary generated and translated by AI from the official description.
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code.
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products
Ivanti · EPMpublic PoCs found — 2
githubgithub.com/horizon3ai/CVE-2024-29824★ 25githubgithub.com/R4be1/CVE-2024-29824★ 1⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Want to know if your infrastructure is exposed to this?
Talk to TrueHacking →