CVE-2024-37843

An attacker sends a properly crafted GraphQL query to the public API endpoint, injecting malicious SQL code. Lack of proper validation and sanitization of input data allows execution of arbitrary SQL commands in the context of the application database. The attack does not require possession of an account or any permissions in the system.

An attacker can obtain unauthorized access to data stored in the database, modify or delete its contents, and under favorable configuration conditions - execute system commands on the server.

Craft CMS should be updated to a version higher than 3.7.31. Patches available from the vendor should be applied according to references. As a temporary workaround, consider restricting access to the GraphQL API endpoint at the firewall or network layer.

Craft CMS in versions up to and including 3.7.31.