CVE-2024-12144
Published: 06 March 2025
Description
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Security Summary
CVE-2024-12144 is an SQL Injection vulnerability (CWE-89), stemming from improper neutralization of special elements used in an SQL command, affecting Finder Fire Safety's Finder ERP/CRM (Old System). The issue impacts all versions prior to 18.12.2024 and was published on 2025-03-06 with a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), classifying it as critical due to its potential for severe impact.
Remote, unauthenticated attackers can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation allows arbitrary SQL command execution, potentially leading to high confidentiality, integrity, and availability impacts, such as unauthorized data access, modification, or disruption of the ERP/CRM system.
Mitigation guidance is provided in the advisory from USOM (Turkish National Cyber Incident Response Center) at https://www.usom.gov.tr/bildirim/tr-25-0060. Affected organizations should update to Finder ERP/CRM (Old System) version 18.12.2024 or later to address the vulnerability.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Remote unauthenticated SQL injection in public-facing ERP/CRM web application directly enables T1190 (Exploit Public-Facing Application) for initial access and arbitrary database command execution.