CVE-2024-48259

HIGHNuclei

Cloudlog - SQL Injection

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2024-48259 has a selected CVSS score of 7.3 (high); EIP currently links 1 Nuclei template.

Description

Cloudlog 2.6.15 allows Oqrs.php request_form SQL injection via station_id or callsign.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Oct 15, 2024 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

cloudlog

Browse magicbug / cloudlog

Default status: unknown

CVE List2.6.15affected

Nuclei templates

1
ProjectDiscoveryHIGHCloudlog - SQL InjectionCVSS 7.3

Cloudlog 2.6.15 contains a SQL injection caused by unsanitized input in oqrs.php request_form, letting attackers execute arbitrary SQL commands via station_id or callsign, exploit requires sending crafted request.

Impact

Attackers can execute arbitrary SQL commands, potentially leading to data theft, modification, or deletion.

Remediation

Update to the latest version of Cloudlog where this issue is fixed, or sanitize inputs properly.

WeaknessesCWE-89
Authorss4e-io
Template tagscvecve2024cloudlogsqlivulnunauth
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CPE: cpe:2.3:a:magicbug:cloudlog:2.6.15:*:*:*:*:*:*:*
FOFA: Login - Cloudlog
https://chiggerlor.substack.com/p/unauthenticated-sql-injection-in-9a3 https://github.com/magicbug/Cloudlog https://nvd.nist.gov/vuln/detail/CVE-2024-48259

Source: ProjectDiscovery

References

4