CVE-2024-55517

CVE-2024-55517 is a SQL injection vulnerability in the Interllect Core Search component of Polaris FT Intellect Core Banking version 9.5. The flaw arises from improper handling of user input passed through the groupType parameter in the /SCGController endpoint, which is directly incorporated into SQL queries without adequate sanitization or parameterization. This issue was publicly disclosed on January 8, 2025, and is classified under CWE-89 with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact.

The vulnerability can be exploited by any authenticated user with low privileges (PR:L) over the network (AV:N) with low attack complexity and no user interaction required. Successful exploitation allows attackers to manipulate SQL queries, potentially leading to high confidentiality, integrity, and availability impacts, such as unauthorized data extraction, modification, or deletion from the underlying database.

Mitigation details and additional technical information are available in the advisory referenced at https://hackmd.io/@AowPhwc/SyvEiDsIye. Security practitioners should prioritize patching or input validation upgrades in affected environments, especially in financial institutions relying on this core banking software.