CVE-2024-6670
CRITICAL KEV RANSOMWARE NUCLEIWhatsUp Gold SQL Injection (CVE-2024-6670)
Title source: metasploitExploitation Summary
CVE-2024-6670 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added September 16, 2024, with confirmed use in ransomware campaigns.
EIP tracks 2 public exploits from researchers including sinsinology, Michael Heinzl, Sina Kheirkhah (@SinSinology) of Summoning Team (@SummoningTeam), including a Metasploit module auxiliary/admin/http/whatsup_gold_sqli.
A Nuclei detection template is also available.
AI-analyzed exploit summary This PoC exploits an SQL injection vulnerability in Progress Software WhatsUp Gold to bypass authentication by updating the admin password. It uses a remote primitive to encrypt the new password and then injects SQL queries to exfiltrate and set the encrypted password.
Description
In WhatsUp Gold versions released before 2024.0.0, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted password.
Exploits (2)
This PoC exploits an SQL injection vulnerability in Progress Software WhatsUp Gold to bypass authentication by updating the admin password. It uses a remote primitive to encrypt the new password and then injects SQL queries to exfiltrate and set the encrypted password.
This Metasploit module exploits a SQL injection vulnerability in WhatsUp Gold to change the password of an existing user (default: admin) to an attacker-controlled one. It leverages a blind SQLi technique to extract and modify credentials.
Nuclei Templates (1)
title:"WhatsUp Gold" http.favicon.hash:-2107233094
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H