Cyber Posture

CVE-2024-56889

HighPublic PoC

Published: 06 February 2025

Published
06 February 2025
Modified
18 April 2025
KEV Added
Patch
CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS Score 0.0336 87.4th percentile
Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may insert, delete, or manipulate data at rest in order to influence external outcomes or hide activity, thus threatening the integrity of the data.

Security Summary

CVE-2024-56889 is an incorrect access control vulnerability in the /admin/m_delete.php endpoint of CodeAstro Complaint Management System version 1.0. Published on 2025-02-06, it enables unauthorized attackers to arbitrarily delete complaints by modifying the id parameter. The issue is rated with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) and maps to CWE-284 (Improper Access Control).

The vulnerability is exploitable remotely over the network with low attack complexity, requiring no authentication privileges, no user interaction, and maintaining unchanged impact scope. Successful exploitation results in high integrity impact through unauthorized deletion of complaints, without affecting confidentiality or availability.

Mitigation details are available in the referenced advisory at https://github.com/vigneshr232/CVE-2024-56889/blob/main/CVE-2024-56889.md.

Details

CWE(s)
CWE-284

Affected Products

codeastro
complaint management system
1.0

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1565.001 Stored Data Manipulation Impact
Adversaries may insert, delete, or manipulate data at rest in order to influence external outcomes or hide activity, thus threatening the integrity of the data.
Why these techniques?

The vulnerability is an access control flaw in a public-facing web application endpoint allowing unauthorized arbitrary deletion of stored data (complaints), enabling T1190 (Exploit Public-Facing Application) and T1565.001 (Stored Data Manipulation).

References