CVE-2024-37843

CRITICAL NUCLEI

Craft CMS < 3.7.31 - Unauthenticated SQL Injection via GraphQL API

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2024-37843. PoCs published by gsmith257-cyber. A Nuclei detection template is also available.

AI-analyzed exploit summary This repository contains a functional proof-of-concept for CVE-2024-37843, demonstrating a time-based blind SQL injection vulnerability in Craft CMS via a maliciously crafted GraphQL query. The exploit uses a `SLEEP` function to confirm vulnerability by measuring response time delays.

Description

Craft CMS up to v3.7.31 was discovered to contain a SQL injection vulnerability via the GraphQL API endpoint.

Exploits (1)

nomisec WORKING POC 4 stars
by gsmith257-cyber · poc
https://github.com/gsmith257-cyber/CVE-2024-37843-POC

This repository contains a functional proof-of-concept for CVE-2024-37843, demonstrating a time-based blind SQL injection vulnerability in Craft CMS via a maliciously crafted GraphQL query. The exploit uses a `SLEEP` function to confirm vulnerability by measuring response time delays.

Classification
Working Poc 90%
Attack Type
Sqli
Complexity
Trivial
Reliability
Reliable
Target: Craft CMS (version not specified)
No auth needed
Prerequisites: Access to the target Craft CMS API endpoint
devstral-2 · analyzed Feb 18, 2026 Full analysis →

Nuclei Templates (1)

Craft CMS <=v3.7.31 - SQL Injection
CRITICALby iamnoooob,rootxharsh,pdresearch
Shodan: cpe:"cpe:2.3:a:craftcms:craft_cms" || http.html:"craftcms" || http.favicon.hash:"-47932290" || X-Powered-By: Craft CMS
FOFA: body=craftcms || icon_hash=-47932290

References (1)

Core 1

Scores

CVSS v3 9.8
EPSS 0.8943
EPSS Percentile 99.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Details

CWE
CWE-89
Status published
Products (2)
craftcms/cms 0Packagist
craftcms/craft_cms < 3.7.31
Published Jun 25, 2024
Tracked Since Feb 18, 2026