exploitDog

CVE-2024-48325

Опубликовано: 06 нояб. 2024

Источник: nvd

CVSS3: 8.1

EPSS Низкий

Описание

Portabilis i-Educar 2.8.0 is vulnerable to SQL Injection in the "getDocuments" function of the "InstituicaoDocumentacaoController" class. The "instituicao_id" parameter in "/module/Api/InstituicaoDocumentacao?oper=get&resource=getDocuments&instituicao_id" is not properly sanitized, allowing an unauthenticated remote attacker to inject malicious SQL commands.

Ссылки

https://github.com/osvaldotenorio/cve-2024-48325
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:portabilis:i-educar:2.8.0:*:*:*:*:*:*:*

EPSS

Процентиль: 93%

0.09712

Низкий

8.1 High

CVSS3

Дефекты

CWE-89

Связанные уязвимости

GHSA-3fgp-h8mw-wrh5

CVSS3: 8.1

github

больше 1 года назад

Portabilis i-Educar 2.8.0 is vulnerable to SQL Injection in the "getDocuments" function of the "InstituicaoDocumentacaoController" class. The "instituicao_id" parameter in "/module/Api/InstituicaoDocumentacao?oper=get&resource=getDocuments&instituicao_id" is not properly sanitized, allowing an unauthenticated remote attacker to inject malicious SQL commands.

EPSS

Процентиль: 93%

0.09712

Низкий

8.1 High

CVSS3

Дефекты

CWE-89