CVE-2024-12916

CVE-2024-12916 is an SQL injection vulnerability (CWE-89) in Agito Computer Life4All, caused by improper neutralization of special elements used in an SQL command. The issue affects Life4All versions prior to 10.01.2025 and was published on 2025-02-24.

The vulnerability carries a CVSS v3.1 base score of 8.8 (High), with attack vector of network (AV:N), low attack complexity (AC:L), low privileges required (PR:L), no user interaction (UI:N), and unchanged scope (S:U). Low-privileged remote attackers can exploit it to achieve high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H), enabling arbitrary SQL command execution such as data exfiltration, modification, or deletion.

The USOM advisory at https://www.usom.gov.tr/bildirim/tr-25-0042 provides details on the vulnerability. Mitigation involves upgrading to Life4All version 10.01.2025 or later.