ExploitCVE-2024-9789
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
Summary
A critical vulnerability has been identified in LyLme_spage version 1.9.5. The issue affects the processing of the file /admin/apply.php, where manipulation of the 'id' argument can lead to SQL injection. This vulnerability can be exploited remotely and does not require user interaction.
Impact
This SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on the underlying database. Given the CVSS v3.1 base score of 7.2 (High severity) and the impacts rated as HIGH for confidentiality, integrity, and availability, successful exploitation could lead to unauthorized access to sensitive data, modification or deletion of database contents, and potential disruption of the application's functionality. The attack vector being NETWORK means it can be exploited remotely, increasing its severity.
Exploitation
One proof-of-concept exploit is available on shikangsi.com. There is no evidence of proof of exploitation at the moment.
Patch
As of the latest information provided, no official patch has been released. The vendor was contacted about this disclosure but did not respond, which may indicate that a patch is not yet available.
Mitigation
1. Implement input validation and parameterized queries to prevent SQL injection attacks. 2. Apply the principle of least privilege to database accounts used by the application. 3. Use web application firewalls (WAF) to filter malicious input. 4. Regularly monitor and audit database activities for suspicious queries. 5. Keep the LyLme_spage application and all associated components up to date with the latest security patches when they become available. 6. Consider temporarily disabling or restricting access to the affected /admin/apply.php file if possible without disrupting critical functionality.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Timeline
Feedly found the first article mentioning CVE-2024-9789. See article
Feedly estimated the CVSS score as HIGH
NVD published the first details for CVE-2024-9789
A CVSS base score of 4.7 has been assigned.
EPSS Score was set to: 0.05% (Percentile: 16.4%)
A CVSS base score of 7.2 has been assigned.