HIGH🇵🇱 Wersja polska

CVE-2024-8749

CVSS 8.8v3.1pub. 2024-09-12upd. 2024-09-18

SQL injection vulnerability in idoit pro version 28. This vulnerability could allow an attacker to send a specially crafted query to the ID parameter in /var/www/html/src/classes/modules/api/model/cmdb/isys_api_model_cmdb_objects_by_relation.class.php and retrieve all the information stored in the database.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

  • I Doit

    APP
    I-Doit
    28
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
SQLi
CWE
References

Related vulnerabilities

CVE-2023-37756CRITICAL9.8PL ✓same product

Słabe wymagania hasła w I-doit pro/open 25 umożliwiają atak brute-force

CVE-2023-37755CRITICAL9.8PL ✓same product

i-doit: zakodowane na stałe dane logowania administratora (Auth Bypass)

CVE-2019-1010248CRITICAL9.8PL ✓same product

SQL Injection w formularzu logowania I-doit — dostęp do bazy bez uwierzytelnienia

CVE-2019-25582HIGH7.1same product

i-doit CMDB 1.12 contains an arbitrary file download vulnerability that allows authenticated attackers to down...

CVE-2019-25581HIGH8.8same product

i-doit CMDB 1.12 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbi...