CVE-2024-54820
Published: 24 February 2025
Description
XOne Web Monitor v02.10.2024.530 framework 1.0.4.9 was discovered to contain a SQL injection vulnerability in the login page. This vulnerability allows attackers to extract all usernames and passwords via a crafted input.
Security Summary
CVE-2024-54820 is a SQL injection vulnerability (CWE-89) in XOne Web Monitor v02.10.2024.530 using framework 1.0.4.9. The issue exists in the login page, where attackers can use crafted input to extract all usernames and passwords from the database. It carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and was published on 2025-02-24.
Unauthenticated attackers with network access can exploit the vulnerability remotely with low complexity and no user interaction required. Exploitation enables extraction of all stored credentials, with high impacts on confidentiality, integrity, and availability as scored by CVSS.
Advisories and further details are available in the GitHub repository at https://github.com/jcarabantes/CVE-2024-54820 and on the vendor site at https://xone.es/.
Details
- CWE(s)