CVE-2024-5276
CRITICAL EXPLOITED NUCLEIFortra FileCatalyst Workflow SQL Injection (CVE-2024-5276)
Title source: metasploitExploitation Summary
CVE-2024-5276 has been observed exploited in the wild (reported by VulnCheck KEV).
EIP tracks 1 public exploit from researchers including Tenable, Michael Heinzl, including a Metasploit module auxiliary/admin/http/fortra_filecatalyst_workflow_sqli.
A Nuclei detection template is also available.
AI-analyzed exploit summary This Metasploit module exploits a SQL injection vulnerability in Fortra FileCatalyst Workflow to add a new administrative user. It automates the process of session token extraction and payload delivery via a crafted SQL query.
Description
A SQL Injection vulnerability in Fortra FileCatalyst Workflow allows an attacker to modify application data. Likely impacts include creation of administrative users and deletion or modification of data in the application database. Data exfiltration via SQL injection is not possible using this vulnerability. Successful unauthenticated exploitation requires a Workflow system with anonymous access enabled, otherwise an authenticated user is required. This issue affects all versions of FileCatalyst Workflow from 5.1.6 Build 135 and earlier.
Exploits (1)
This Metasploit module exploits a SQL injection vulnerability in Fortra FileCatalyst Workflow to add a new administrative user. It automates the process of session token extraction and payload delivery via a crafted SQL query.
Nuclei Templates (1)
body="FileCatalyst file transfer solution, easily transfer large files"
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H