CVE-2024-41702

The vulnerability results from improper neutralization of special characters in input data passed to SQL commands (Improper Neutralization of Special Elements used in an SQL Command). An attacker can inject malicious SQL code fragments into queries executed by the application, allowing manipulation of database logic. The attack requires no authentication or user interaction and can be carried out remotely over the network.

An attacker can gain unauthorized access to data stored in the database, modify or delete data, and potentially take control of the system, resulting in a complete breach of the application's confidentiality, integrity, and availability.

Patches available from the vendor should be applied in accordance with the references provided. Additionally, it is recommended to restrict access to the application at the firewall level and implement WAF (Web Application Firewall) mechanisms as a temporary measure until the updates are applied.

SiberianCMS — versions specified in vendor references