dingfanzu CMS Dok 29d67d9044f6f93378e6eb6ff92272217ff7225c /ajax/getBasicInfo.php Korisničko ime SKL injekcija

Otkrivena je ranjivost klasifikovana kao Kritične u dingfanzu CMS Dok 29d67d9044f6f93378e6eb6ff92272217ff7225c. Pogođeno je nepoznata funkcija u fajlu /ajax/getBasicInfo.php. Manipulacija argumentom Korisničko ime dovodi do SKL injekcija. Korišćenjem CWE za opis problema dolazi se do CWE-89. Slabost je objavljena 08/29/2024. Izveštaj je dostupan za preuzimanje na github.com. Ova ranjivost je poznata pod oznakom CVE-2024-8303. Napad je moguće izvršiti sa udaljene lokacije. Napad zahteva pristup lokalnoj mreži. Tehnički podaci su dostupni. Додатно, постоји доступан експлоит. Eksploatacija je javno objavljena i može biti iskorišćena. Trenutna cena za eksploataciju može biti približno USD $0-$5k u ovom trenutku. Prema MITRE ATT&CK projektu, tehnika napada je T1505. Definisano je kao dokaz-of-koncept. Ekspoit je objavljen za preuzimanje na github.com. Kao 0-day, očekivana cena na crnom tržištu bila je oko $0-$5k. Ovaj proizvod koristi model neprekidnog izdanja (rolling release) za kontinuiranu isporuku, te zbog toga nema dostupnih informacija o verzijama pogođenih ili ažuriranih izdanja. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

3 Promene · 77 Tačke podataka

PoljeKreirali
08/29/2024 09:31		Ažurira 1/2
08/29/2024 18:46		Ažurira 2/2
08/31/2024 08:32
software_vendordingfanzudingfanzudingfanzu
software_nameCMSCMSCMS
software_version<=29d67d9044f6f93378e6eb6ff92272217ff7225c<=29d67d9044f6f93378e6eb6ff92272217ff7225c<=29d67d9044f6f93378e6eb6ff92272217ff7225c
software_rollingrelease111
software_file/ajax/getBasicInfo.php/ajax/getBasicInfo.php/ajax/getBasicInfo.php
software_argumentusernameusernameusername
vulnerability_cweCWE-89 (SKL injekcija)CWE-89 (SKL injekcija)CWE-89 (SKL injekcija)
vulnerability_risk222
cvss3_vuldb_avNNN
cvss3_vuldb_acLLL
cvss3_vuldb_uiNNN
cvss3_vuldb_sUUU
cvss3_vuldb_cLLL
cvss3_vuldb_iLLL
cvss3_vuldb_aLLL
cvss3_vuldb_ePPP
cvss3_vuldb_rcRRR
advisory_urlhttps://github.com/Xor-Gerke/webray.com.cn/blob/main/cve/dingfanzu-CMS/dingfanzu-CMS%20getBasicInfo.php%20username%20SQL-inject.mdhttps://github.com/Xor-Gerke/webray.com.cn/blob/main/cve/dingfanzu-CMS/dingfanzu-CMS%20getBasicInfo.php%20username%20SQL-inject.mdhttps://github.com/Xor-Gerke/webray.com.cn/blob/main/cve/dingfanzu-CMS/dingfanzu-CMS%20getBasicInfo.php%20username%20SQL-inject.md
exploit_availability111
exploit_publicity111
exploit_urlhttps://github.com/Xor-Gerke/webray.com.cn/blob/main/cve/dingfanzu-CMS/dingfanzu-CMS%20getBasicInfo.php%20username%20SQL-inject.mdhttps://github.com/Xor-Gerke/webray.com.cn/blob/main/cve/dingfanzu-CMS/dingfanzu-CMS%20getBasicInfo.php%20username%20SQL-inject.mdhttps://github.com/Xor-Gerke/webray.com.cn/blob/main/cve/dingfanzu-CMS/dingfanzu-CMS%20getBasicInfo.php%20username%20SQL-inject.md
source_cveCVE-2024-8303CVE-2024-8303CVE-2024-8303
cna_responsibleVulDBVulDBVulDB
response_summaryThe vendor was contacted early about this disclosure but did not respond in any way.The vendor was contacted early about this disclosure but did not respond in any way.The vendor was contacted early about this disclosure but did not respond in any way.
software_typeContent Management SystemContent Management SystemContent Management System
cvss2_vuldb_avNNN
cvss2_vuldb_acLLL
cvss2_vuldb_ciPPP
cvss2_vuldb_iiPPP
cvss2_vuldb_aiPPP
cvss2_vuldb_ePOCPOCPOC
cvss2_vuldb_rcURURUR
cvss4_vuldb_avNNN
cvss4_vuldb_acLLL
cvss4_vuldb_uiNNN
cvss4_vuldb_vcLLL
cvss4_vuldb_viLLL
cvss4_vuldb_vaLLL
cvss4_vuldb_ePPP
cvss2_vuldb_auSSS
cvss2_vuldb_rlNDNDND
cvss3_vuldb_prLLL
cvss3_vuldb_rlXXX
cvss4_vuldb_atNNN
cvss4_vuldb_prLLL
cvss4_vuldb_scNNN
cvss4_vuldb_siNNN
cvss4_vuldb_saNNN
cvss2_vuldb_basescore6.56.56.5
cvss2_vuldb_tempscore5.65.65.6
cvss3_vuldb_basescore6.36.36.3
cvss3_vuldb_tempscore5.75.75.7
cvss3_meta_basescore6.36.36.3
cvss3_meta_tempscore5.76.06.0
cvss4_vuldb_bscore5.35.35.3
cvss4_vuldb_btscore2.12.12.1
advisory_date1724882400 (08/29/2024)1724882400 (08/29/2024)1724882400 (08/29/2024)
price_0day$0-$5k$0-$5k$0-$5k
cve_nvd_summaryA vulnerability classified as critical has been found in dingfanzu CMS up to 29d67d9044f6f93378e6eb6ff92272217ff7225c. This affects an unknown part of the file /ajax/getBasicInfo.php. The manipulation of the argument username leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.A vulnerability classified as critical has been found in dingfanzu CMS up to 29d67d9044f6f93378e6eb6ff92272217ff7225c. This affects an unknown part of the file /ajax/getBasicInfo.php. The manipulation of the argument username leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
cvss3_cna_avNN
cvss3_cna_acLL
cvss3_cna_prLL
cvss3_cna_uiNN
cvss3_cna_sUU
cvss3_cna_cLL
cvss3_cna_iLL
cvss3_cna_aLL
cvss3_cna_basescore6.36.3
cvss2_cna_avNN
cvss2_cna_acLL
cvss2_cna_auSS
cvss2_cna_ciPP
cvss2_cna_iiPP
cvss2_cna_aiPP
cvss2_cna_basescore6.56.5
cve_nvd_summaryesSe ha encontrado una vulnerabilidad clasificada como crítica en dingfanzu CMS hasta 29d67d9044f6f93378e6eb6ff92272217ff7225c. Afecta a una parte desconocida del archivo /ajax/getBasicInfo.php. La manipulación del argumento username provoca una inyección SQL. Es posible iniciar el ataque de forma remota. El exploit se ha divulgado al público y puede utilizarse. Este producto no utiliza control de versiones. Por este motivo, no está disponible la información sobre las versiones afectadas y no afectadas. NOTA: Se contactó primeramente con el proveedor sobre esta divulgación, pero no respondió de ninguna manera.

◂ PrethodnePregledSledeжi ▸

Might our Artificial Intelligence support you?

Check our Alexa App!