CVE-2024-53544

CVE-2024-53544 is a SQL injection vulnerability (CWE-89) affecting NovaCHRON Zeitsysteme GmbH & Co. KG's Smart Time Plus software in versions v8.x through v8.6. The issue resides in the getCookieNames method of the smarttimeplus/MySQLConnection endpoint, allowing malicious input to influence SQL query construction and execution.

The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating it is exploitable over the network with low complexity, no privileges, and no user interaction required. Unauthenticated remote attackers can leverage this flaw to achieve high impacts on confidentiality, integrity, and availability, such as executing arbitrary SQL commands to extract, modify, or delete database contents.

A reference advisory is available at https://secure77.de/smart-time-plus-rce-cve-2024-53543/, which covers a related issue in the same product but does not specify mitigations or patches for CVE-2024-53544.