TreasureHuntGame TreasureHunt Dok 963e0e0 TreasureHunt/acesso.php usuario SKL injekcija

Otkrivena je ranjivost klasifikovana kao Kritične u TreasureHuntGame TreasureHunt Dok 963e0e0. Pogođeno je nepoznata funkcija u fajlu TreasureHunt/acesso.php. Manipulacija argumentom usuario dovodi do SKL injekcija. Korišćenje CWE za deklarisanje problema vodi do CWE-89. Slabost je objavljena 12/21/2024 kao 8bcc649abc35b7734951be084bb522a532faac4e. Obaveštenje je dostupno za preuzimanje na github.com. Ova ranjivost je označena kao CVE-2024-12894. Moguće je pokrenuti napad na daljinu. Napad mora biti izveden unutar lokalne mreže. Tehnički detalji su dostupni. Не постоји доступан експлоит. Trenutna cena za eksploataciju može biti približno USD $0-$5k u ovom trenutku. MITRE ATT&CK projekat deklariše tehniku napada kao T1505. Označeno je kao nije definisano. Kao 0-day, procenjena cena na crnom tržištu bila je oko $0-$5k. Ovaj proizvod koristi rolling release model za kontinuiranu isporuku. Zbog toga, podaci o verzijama pogođenih ili ažuriranih izdanja nisu dostupni. Ime zakrpe je 8bcc649abc35b7734951be084bb522a532faac4e. Ispravka je spremna za preuzimanje na github.com. Preporučuje se primena zakrpe kako bi se rešio ovaj problem. VulDB is the best source for vulnerability data and more expert information about this specific topic.

3 Promene · 100 Tačke podataka

PoljeKreirali
12/21/2024 21:22		Ažurira 1/2
12/22/2024 13:30		Ažurira 2/2
01/11/2025 03:05
software_vendorTreasureHuntGameTreasureHuntGameTreasureHuntGame
software_nameTreasureHuntTreasureHuntTreasureHunt
software_version<=963e0e0<=963e0e0<=963e0e0
software_rollingrelease111
software_fileTreasureHunt/acesso.phpTreasureHunt/acesso.phpTreasureHunt/acesso.php
software_argumentusuariousuariousuario
vulnerability_cweCWE-89 (SKL injekcija)CWE-89 (SKL injekcija)CWE-89 (SKL injekcija)
vulnerability_risk222
cvss3_vuldb_avNNN
cvss3_vuldb_acLLL
cvss3_vuldb_uiNNN
cvss3_vuldb_sUUU
cvss3_vuldb_cLLL
cvss3_vuldb_iLLL
cvss3_vuldb_aLLL
cvss3_vuldb_rlOOO
cvss3_vuldb_rcCCC
advisory_identifier8bcc649abc35b7734951be084bb522a532faac4e8bcc649abc35b7734951be084bb522a532faac4e8bcc649abc35b7734951be084bb522a532faac4e
advisory_urlhttps://github.com/TreasureHuntGame/TreasureHunt/commit/8bcc649abc35b7734951be084bb522a532faac4ehttps://github.com/TreasureHuntGame/TreasureHunt/commit/8bcc649abc35b7734951be084bb522a532faac4ehttps://github.com/TreasureHuntGame/TreasureHunt/commit/8bcc649abc35b7734951be084bb522a532faac4e
countermeasure_nameZakrpaZakrpaZakrpa
patch_name8bcc649abc35b7734951be084bb522a532faac4e8bcc649abc35b7734951be084bb522a532faac4e8bcc649abc35b7734951be084bb522a532faac4e
countermeasure_patch_urlhttps://github.com/TreasureHuntGame/TreasureHunt/commit/8bcc649abc35b7734951be084bb522a532faac4ehttps://github.com/TreasureHuntGame/TreasureHunt/commit/8bcc649abc35b7734951be084bb522a532faac4ehttps://github.com/TreasureHuntGame/TreasureHunt/commit/8bcc649abc35b7734951be084bb522a532faac4e
countermeasure_advisoryquotefix(acesso.php e checkflag.php): SQL Injectionfix(acesso.php e checkflag.php): SQL Injectionfix(acesso.php e checkflag.php): SQL Injection
source_cveCVE-2024-12894CVE-2024-12894CVE-2024-12894
cna_responsibleVulDBVulDBVulDB
cvss2_vuldb_avNNN
cvss2_vuldb_acLLL
cvss2_vuldb_ciPPP
cvss2_vuldb_iiPPP
cvss2_vuldb_aiPPP
cvss2_vuldb_rcCCC
cvss2_vuldb_rlOFOFOF
cvss4_vuldb_avNNN
cvss4_vuldb_acLLL
cvss4_vuldb_uiNNN
cvss4_vuldb_vcLLL
cvss4_vuldb_viLLL
cvss4_vuldb_vaLLL
cvss2_vuldb_auSSS
cvss2_vuldb_eNDNDND
cvss3_vuldb_prLLL
cvss3_vuldb_eXXX
cvss4_vuldb_atNNN
cvss4_vuldb_prLLL
cvss4_vuldb_scNNN
cvss4_vuldb_siNNN
cvss4_vuldb_saNNN
cvss4_vuldb_eXXX
cvss2_vuldb_basescore6.56.56.5
cvss2_vuldb_tempscore5.75.75.7
cvss3_vuldb_basescore6.36.36.3
cvss3_vuldb_tempscore6.06.06.0
cvss3_meta_basescore6.36.37.5
cvss3_meta_tempscore6.06.17.4
cvss4_vuldb_bscore5.35.35.3
cvss4_vuldb_btscore5.35.35.3
advisory_date1734735600 (12/21/2024)1734735600 (12/21/2024)1734735600 (12/21/2024)
price_0day$0-$5k$0-$5k$0-$5k
cve_nvd_summaryA vulnerability, which was classified as critical, was found in TreasureHuntGame TreasureHunt up to 963e0e0. Affected is an unknown function of the file TreasureHunt/acesso.php. The manipulation of the argument usuario leads to sql injection. It is possible to launch the attack remotely. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The name of the patch is 8bcc649abc35b7734951be084bb522a532faac4e. It is recommended to apply a patch to fix this issue.A vulnerability, which was classified as critical, was found in TreasureHuntGame TreasureHunt up to 963e0e0. Affected is an unknown function of the file TreasureHunt/acesso.php. The manipulation of the argument usuario leads to sql injection. It is possible to launch the attack remotely. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The name of the patch is 8bcc649abc35b7734951be084bb522a532faac4e. It is recommended to apply a patch to fix this issue.
cvss4_cna_avNN
cvss4_cna_acLL
cvss4_cna_atNN
cvss4_cna_prLL
cvss4_cna_uiNN
cvss4_cna_vcLL
cvss4_cna_viLL
cvss4_cna_vaLL
cvss4_cna_scNN
cvss4_cna_siNN
cvss4_cna_saNN
cvss4_cna_bscore5.35.3
cvss3_cna_avNN
cvss3_cna_acLL
cvss3_cna_prLL
cvss3_cna_uiNN
cvss3_cna_sUU
cvss3_cna_cLL
cvss3_cna_iLL
cvss3_cna_aLL
cvss3_cna_basescore6.36.3
cvss2_cna_avNN
cvss2_cna_acLL
cvss2_cna_auSS
cvss2_cna_ciPP
cvss2_cna_iiPP
cvss2_cna_aiPP
cvss2_cna_basescore6.56.5
cve_nvd_summaryesSe ha encontrado una vulnerabilidad clasificada como crítica en TreasureHuntGame TreasureHunt hasta la versión 963e0e0. Se ve afectada una función desconocida del archivo TreasureHunt/acesso.php. La manipulación del argumento usuario provoca una inyección SQL. Es posible lanzar el ataque de forma remota. Este producto utiliza una versión continua para proporcionar una distribución continua. Por lo tanto, no hay detalles de la versión afectada ni de las versiones actualizadas disponibles. El nombre del parche es 8bcc649abc35b7734951be084bb522a532faac4e. Se recomienda aplicar un parche para solucionar este problema.
cvss3_nvd_avN
cvss3_nvd_acL
cvss3_nvd_prN
cvss3_nvd_uiN
cvss3_nvd_sU
cvss3_nvd_cH
cvss3_nvd_iH
cvss3_nvd_aH
cvss3_nvd_basescore9.8

◂ PrethodnePregledSledeжi ▸

Are you interested in using VulDB?

Download the whitepaper to learn more about our service!