HIGH🇬🇧 English

CVE-2024-8749

CVSS 8.8v3.1pub. 2024-09-12upd. 2024-09-18

SQL injection vulnerability in idoit pro version 28. This vulnerability could allow an attacker to send a specially crafted query to the ID parameter in /var/www/html/src/classes/modules/api/model/cmdb/isys_api_model_cmdb_objects_by_relation.class.php and retrieve all the information stored in the database.

oryginał EN
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

  • I Doit

    APP
    I-Doit
    28
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
Tagi
SQLi
CWE
Referencje

Powiązane podatności

CVE-2023-37756CRITICAL9.8ten sam produkt

I-doit pro 25 and below and I-doit open 25 and below employ weak password requirements for Administrator accou...

CVE-2023-37755CRITICAL9.8ten sam produkt

i-doit pro 25 and below and I-doit open 25 and below are configured with insecure default administrator creden...

CVE-2019-1010248CRITICAL9.8ten sam produkt

Synetics GmbH I-doit 1.12 and earlier is affected by: SQL Injection. The impact is: Unauthenticated mysql data...

CVE-2019-25582HIGH7.1ten sam produkt

i-doit CMDB 1.12 contains an arbitrary file download vulnerability that allows authenticated attackers to down...

CVE-2019-25581HIGH8.8ten sam produkt

i-doit CMDB 1.12 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbi...