CVE-2024-26264

EBM Technologies RISWEB - SQL Injection

CVSS 9.8 CRITICALEPSS 0.8%CWE-89

Vexday Risk Score

28Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 9.8EPSS 0.8%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

15 fev 2024Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

EBM Technologies RISWEB's specific query function parameter does not properly restrict user input, and this feature page is accessible without login. This allows remote attackers to inject SQL commands without authentication, enabling them to read, modify, and delete database records.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Produtos afetados

EBM Technologies · RISWEB

Referências

https://www.twcert.org.tw/tw/cp-132-7677-b1c0f-1.html