CVE-2024-9201

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

Published: Oct 10, 2024 / Updated: 40d ago

010
CVSS 9.8EPSS 0.04%Critical
CVE info copied to clipboard

Summary

The SEUR plugin, in its versions prior to 2.5.11, is vulnerable to time-based SQL injection through the use of the 'id_order' parameter of the '/modules/seur/ajax/saveCodFee.php' endpoint. This vulnerability allows for potential unauthorized access to sensitive data, manipulation of database contents, and possible execution of arbitrary commands on the database server. In severe cases, it could lead to complete system compromise.

Impact

This vulnerability has a high severity with a CVSS v3.1 base score of 9.8 out of 10. The impact on confidentiality, integrity, and availability is high. An attacker can exploit this vulnerability remotely over the network without requiring any privileges or user interaction. Potential impacts include: 1. Unauthorized access to sensitive data stored in the database 2. Manipulation or corruption of database contents 3. Possible execution of arbitrary commands on the database server 4. In severe cases, complete system compromise The vulnerability affects the SEUR plugin for PrestaShop, which could potentially impact e-commerce operations if exploited.

Exploitation

There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.

Patch

A patch is available. The vulnerability has been addressed in version 2.5.11 of the SEUR plugin. Users should update to this version or later to mitigate the risk.

Mitigation

1. Update the SEUR plugin to version 2.5.11 or later immediately. 2. If immediate updating is not possible, consider temporarily disabling the SEUR plugin until the update can be applied. 3. Implement input validation and parameterized queries for the affected endpoint to prevent SQL injection attacks. 4. Use the principle of least privilege for database accounts used by the application. 5. Regularly monitor and audit database activities for any suspicious queries or unauthorized access attempts. 6. Implement a Web Application Firewall (WAF) to help detect and block SQL injection attempts. 7. Conduct a thorough security review of other parts of the application to identify and address any similar vulnerabilities.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Timeline

CVE Assignment

NVD published the first details for CVE-2024-9201

Oct 10, 2024 at 11:15 AM
CVSS

A CVSS base score of 9.4 has been assigned.

Oct 10, 2024 at 11:20 AM / nvd
First Article

Feedly found the first article mentioning CVE-2024-9201. See article

Oct 10, 2024 at 11:24 AM / National Vulnerability Database
CVSS Estimate

Feedly estimated the CVSS score as HIGH

Oct 10, 2024 at 11:24 AM
EPSS

EPSS Score was set to: 0.04% (Percentile: 9.7%)

Oct 11, 2024 at 10:19 AM
CVSS

A CVSS base score of 9.8 has been assigned.

Oct 16, 2024 at 5:00 PM / nvd
Static CVE Timeline Graph

Affected Systems

Seur/seur
+null more

Attack Patterns

CAPEC-108: Command Line Execution through SQL Injection
+null more

News

CVE Alert: CVE-2024-9201 - https://www.redpacketsecurity.com/cve_alert_cve-2024-9201/ #OSINT #ThreatIntel #CyberSecurity #cve_2024_9201
CVE Alert: CVE-2024-9201 - redpacketsecurity.com/cve_al… #OSINT #ThreatIntel #CyberSecurity #cve_2024_9201
CVE Alert: CVE-2024-9201 - https://www. redpacketsecurity.com/cve_aler t_cve-2024-9201/ # OSINT # ThreatIntel # CyberSecurity # cve_2024_9201
NA - CVE-2024-9201 - The SEUR plugin, in its versions prior to...
The SEUR plugin, in its versions prior to 2.5.11, is vulnerable to time-based SQL injection through the use of the ‘id_order’ parameter of the ‘/modules/seur/ajax/saveCodFee.php’ endpoint.
cveNotify : 🚨 CVE-2024-9201The SEUR plugin, in its versions prior to 2.5.11, is vulnerable to time-based SQL injection through the use of the ‘id_order’ parameter of the ‘/modules/seur/ajax/saveCodFee.php’ endpoint.🎖@cveNotify
cveNotify : 🚨 CVE-2024-9201The SEUR plugin, in its versions prior to 2.5.11, is vulnerable to time-based SQL injection through the use of the ‘id_order’ parameter of the ‘/modules/seur/ajax/saveCodFee.php’ endpoint.🎖@cveNotify
CVE-2024-9201 - Apache SEUR Time-Based SQL Injection Vulnerability
CVE ID : CVE-2024-9201 Published : Oct. 10, 2024, 11:15 a.m. 20 minutes ago Description : The SEUR plugin, in its versions prior to 2.5.11, is vulnerable to time-based SQL injection through the use of the ‘id_order’ parameter of the ‘/modules/seur/ajax/saveCodFee.php’ endpoint. Severity: 9.4 CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...
See 5 more articles and social media posts

CVSS V3.1

Attack Vector:Network
Attack Complexity:Low
Privileges Required:None
User Interaction:None
Scope:Unchanged
Confidentiality:High
Integrity:High
Availability Impact:High

Categories

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI