CVE-2024-24572

Katalog CVE

CVSS 6.5 · Medium EPSS 0,64%

Kerentanan Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') pada facilemanager. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

facileManager is a modular suite of web apps built with the sysadmin in mind. In versions 4.5.0 and earlier, the $_REQUEST global array was unsafely called inside an extract() function in admin-logs.php. The PHP file fm-init.php prevents arbitrary manipulation of $_SESSION via the GET/POST parameters. However, it does not prevent manipulation of any other sensitive variables such as $search_sql. Knowing this, an authenticated user with privileges to view site logs can manipulate the search_sql variable by appending a GET parameter search_sql in the URL. The information above means that the checks and SQL injection prevention attempts were rendered unusable.

Rincian

Terbit di NVD

31 Januari 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

EPSS (30 hari)

0,64% peluang dieksploitasi; lebih tinggi dari 49,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/WillyXJ/facileManager/security/advisories/GHSA-xw34-8pj6-75gc exploit · advisory vendor
• https://github.com/WillyXJ/facileManager/commit/0aa850d4b518f10143a4c675142b15caa5872877 patch