Lucene search

MitreCVE-2024-45265

HistoryAug 26, 2024 - 6:15 p.m.

CVE-2024-45265

2024-08-2618:15:07

CWE-89

CWE-79

mitre

web.nvd.nist.gov

sql injection

skysystem arfa-cms

poll component

remote attackers

arbitrary sql commands

psid parameter

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

8.7

Confidence

Low

EPSS

0.001

Percentile

39.7%

JSON

A SQL injection vulnerability in the poll component in SkySystem Arfa-CMS before 5.1.3124 allows remote attackers to execute arbitrary SQL commands via the psid parameter.

Affected configurations

Nvd

Node

skyssarfa-cmsRange<5.1.3132

VendorProductVersionCPE
skyssarfa-cms*cpe:2.3:a:skyss:arfa-cms:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
skyss	arfa-cms	*	cpe:2.3:a:skyss:arfa-cms::::::::

References

github.com/TheHermione/CVE-2024-45265

skyss.ru

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

8.7

Confidence

Low

EPSS

0.001

Percentile

39.7%

JSON

Related for CVE-2024-45265