nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2024-7801 CVE-2024-7801
MEDIUM
SQL injection in get_chart_data in TimeProvider 4100
Record summary
CVE-2024-7801 has a selected CVSS score of 6.3 (medium); EIP currently links 1 catalogued exploit.
Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Microchip TimeProvider 4100 (Data plot modules) allows SQL Injection.This issue affects TimeProvider 4100: from 1.0 before 2.4.7.
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 1
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Oct 4, 2024 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
TimeProvider 4100Browse Microchip / TimeProvider 4100Default status: unaffected | CVE List | 1.0 to < 2.4.7 | affected |
Proofs of concept
1Catalogued exploits
ExploitDBMicrochip TimeProvider 4100 Grandmaster (Data plot modules) 2.4.6 - SQL InjectionExploitDB exploitby Armando Huesca PridaNot analyzed1 file
References
3gruppotim.itThird-party advisory
https://www.gruppotim.it/it/footer/red-team.html microchip.comVendor advisory
https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timeprovider-4100-grandmaster-unathenticated-sql-injection