CVE-2024-9972

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

Published: Oct 15, 2024 / Updated: 35d ago

010
CVSS 9.8EPSS 0.09%Critical
CVE info copied to clipboard

Summary

Property Management System from ChanGate has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents.

Impact

This vulnerability allows unauthenticated remote attackers to execute arbitrary SQL commands on the affected system. The potential impacts are severe: 1. Data Breach: Attackers can read sensitive information from the database, potentially exposing customer data, financial information, or other confidential records. 2. Data Manipulation: The ability to modify database contents could lead to the alteration of critical business data, potentially affecting the integrity of financial records, reservation details, or other important information. 3. Data Loss: Attackers can delete database contents, potentially causing significant operational disruptions and data loss. 4. Privilege Escalation: Depending on the database configuration, attackers might be able to elevate their privileges within the system. 5. System Compromise: In some cases, SQL injection can lead to broader system compromise, potentially allowing attackers to execute commands on the underlying operating system.

Exploitation

There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.

Patch

As of the vulnerability publication date (October 15, 2024), there is no information provided about an available patch. The security team should monitor ChanGate's official channels for any security updates or patches related to this vulnerability.

Mitigation

While waiting for an official patch, consider implementing the following mitigation strategies: 1. Input Validation: Implement strict input validation and sanitization for all user inputs that interact with the database. 2. Parameterized Queries: Use parameterized queries or prepared statements instead of concatenating user input directly into SQL queries. 3. Least Privilege: Ensure that the database user used by the application has the minimum necessary privileges. 4. Web Application Firewall (WAF): Deploy a WAF configured to detect and block SQL injection attempts. 5. Network Segmentation: Isolate the Property Management System from untrusted networks as much as possible. 6. Regular Audits: Conduct regular security audits and penetration testing to identify and address potential vulnerabilities. 7. Monitor for Suspicious Activity: Implement logging and monitoring to detect any unusual database queries or activities that could indicate exploitation attempts.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Timeline

CVE Assignment

NVD published the first details for CVE-2024-9972

Oct 15, 2024 at 7:15 AM
CVSS

A CVSS base score of 9.8 has been assigned.

Oct 15, 2024 at 7:20 AM / nvd
First Article

Feedly found the first article mentioning CVE-2024-9972. See article

Oct 15, 2024 at 7:24 AM / National Vulnerability Database
CVSS Estimate

Feedly estimated the CVSS score as HIGH

Oct 15, 2024 at 7:24 AM
EPSS

EPSS Score was set to: 0.09% (Percentile: 39.8%)

Oct 16, 2024 at 11:00 AM
Static CVE Timeline Graph

Attack Patterns

CAPEC-108: Command Line Execution through SQL Injection
+null more

News

Vulnerability Summary for the Week of October 14, 2024
High Vulnerabilities Primary Vendor — Product Description Published CVSS Score Source Info Patch Info Acespritech Solutions Pvt. Ltd.–Social Link Groups Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Acespritech Solutions Pvt. Ltd. Social Link Groups allows Blind SQL Injection.This issue affects Social Link Groups: from n/a through 1.1.0. 2024-10-20 8.5 CVE-2024-49619 audit@patchstack.com acm309–PutongOJ PutongOJ is online judging software. Prior to version 2.1.0-beta.1, unprivileged users can escalate privileges by constructing requests. This can lead to unauthorized access, enabling users to perform admin-level operations, potentially compromising sensitive data and system integrity. This problem has been fixed in v2.1.0.beta.1. As a workaround, one may apply the patch from commit `211dfe9` manually.
US-CERT Vulnerability Summary for the Week of October 14, 2024
Primary Vendor — Product Description Published CVSS Score Source Info Patch Info Acespritech Solutions Pvt. Ltd.–Social Link Groups Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Acespritech Solutions Pvt. Ltd. Social Link Groups allows Blind SQL Injection.This issue affects Social Link Groups: from n/a through 1.1.0. 2024-10-20 8.5 CVE-2024-49619 [email protected] acm309–PutongOJ PutongOJ is online judging software. Prior to version 2.1.0-beta.1, unprivileged users can escalate privileges by constructing requests. This can lead to unauthorized access, enabling users to perform admin-level operations, potentially compromising sensitive data and system integrity. This problem has been fixed in v2.1.0.beta.1. As a workaround, one may apply the patch from commit `211dfe9` manually.
Vulnerability Summary for the Week of October 14, 2024
High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source Info Patch Info Acespritech Solutions Pvt. Ltd.--Social Link Groups Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Acespritech Solutions Pvt. Ltd. Social Link Groups allows Blind SQL Injection.This issue affects Social Link Groups: from n/a through 1.1.0. 2024-10-20 8.5 CVE-2024-49619 audit@patchstack.com acm309--PutongOJ PutongOJ is online judging software. Prior to version 2.1.0-beta.1, unprivileged users can escalate privileges by constructing requests. This can lead to unauthorized access, enabling users to perform admin-level operations, potentially compromising sensitive data and system integrity. This problem has been fixed in v2.1.0.beta.1. As a workaround, one may apply the patch from commit `211dfe9` manually.
Critical - CVE-2024-9972 - Property Management System from ChanGate has a...
Property Management System from ChanGate has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents.
CVE-2024-9972 - Changate Property Management System SQL Injection Vulnerability
CVE ID : CVE-2024-9972 Published : Oct. 15, 2024, 7:15 a.m. 49 minutes ago Description : Property Management System from ChanGate has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents. Severity: 9.8 CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...
See 6 more articles and social media posts

CVSS V3.1

Attack Vector:Network
Attack Complexity:Low
Privileges Required:None
User Interaction:None
Scope:Unchanged
Confidentiality:High
Integrity:High
Availability Impact:High

Categories

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI