CVE-2024-25227

CRITICAL

ABO.CMS <5.8 - SQL Injection

Title source: llm

Description

SQL Injection vulnerability in ABO.CMS version 5.8, allows remote attackers to execute arbitrary code, cause a denial of service (DoS), escalate privileges, and obtain sensitive information via the tb_login parameter in admin login page.

Exploits (2)

nomisec WORKING POC

by thetrueartist · poc

https://github.com/thetrueartist/ABO.CMS-EXPLOIT-Unauthenticated-Login-Bypass-CVE-2024-25227

View Code ZIP pw:eip

nomisec WRITEUP

by thetrueartist · poc

https://github.com/thetrueartist/ABO.CMS-Login-SQLi-CVE-2024-25227

View Code ZIP pw:eip

References (1)

[Exploit, Third Party Advisory] https://thetrueartist.wixsite.com/cveblog/post/understanding-the-potential-impact-of-cve-2024-25227-what-you-need-to-know-and-how-it-was-discovered

Scores

CVSS v3 9.8

EPSS 0.0062

EPSS Percentile 70.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-89

Status published

Products (1)

abocms/abo.cms 5.8

Published Mar 15, 2024

Tracked Since Feb 18, 2026