CVE-2024-9465
CRITICAL KEV NUCLEIPalo Alto Networks Expedition 1.2.0-1.2.95 - Unauthenticated SQL Injection and Arbitrary File Write
Title source: llmExploitation Summary
CVE-2024-9465 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added November 14, 2024. EIP tracks 2 public exploits from researchers including horizon3ai, Qlng. A Nuclei detection template is also available.
AI-analyzed exploit summary This PoC demonstrates an unauthenticated SQL injection vulnerability in Palo Alto Expedition by creating a checkpoint table and injecting a sleep-based payload to confirm exploitation. It targets a specific endpoint and leverages time-based blind SQLi.
Description
An SQL injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. With this, attackers can also create and read arbitrary files on the Expedition system.
Exploits (2)
This PoC demonstrates an unauthenticated SQL injection vulnerability in Palo Alto Expedition by creating a checkpoint table and injecting a sleep-based payload to confirm exploitation. It targets a specific endpoint and leverages time-based blind SQLi.
This repository contains a Python-based proof-of-concept exploit for CVE-2024-9465, a time-based SQL injection vulnerability in Checkpoint's Expedition Project. The exploit demonstrates the vulnerability by injecting a sleep payload to confirm the presence of the SQLi.
Nuclei Templates (1)
http.favicon.hash:1499876150
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N