CVE-2024-39250

CRITICALNuclei

EfroTech Timetrax v8.3 - Sql Injection

Title source: github.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2024-39250 has a selected CVSS score of 9.8 (critical); EIP currently links 1 repository PoC and 1 Nuclei template.

Description

EfroTech Timetrax v8.3 was discovered to contain an unauthenticated SQL injection vulnerability via the q parameter in the search web interface.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1
Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Jul 24, 2024 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

timetrax

Browse efrotech / timetrax

Default status: unknown

CVE List8.3affected

Proofs of concept

1

Repository PoCs

GitHubefrann/CVE-2024-39250Repository PoCby efrann1Not analyzed2 files

829 B

GitHub
PoC details

Nuclei templates

1
ProjectDiscoveryHIGHEfroTech Timetrax v8.3 - Sql Injection

EfroTech Timetrax v8.3 was discovered to contain an unauthenticated SQL injection vulnerability via the q parameter in the search web interface.

Impact

Unauthenticated attackers can execute SQL injection attacks to extract or modify sensitive timetrax database information.

Remediation

Update EfroTech Timetrax to a version later than v8.3 that patches the SQL injection vulnerability.

Authorss4e-io, efran
Template tagscvecve2024sqlitimetraxvuln
FOFA: icon_hash="-661694518"
https://nvd.nist.gov/vuln/detail/CVE-2024-39250 https://www.tenable.com/cve/CVE-2024-39250 https://github.com/efrann/CVE-2024-39250 https://vuldb.com/?id.272268

Source: ProjectDiscovery

References

2