CVE-2024-57034
Published: 17 January 2025
Description
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Security Summary
CVE-2024-57034 is a SQL injection vulnerability (CWE-89) affecting WeGIA versions prior to 3.2.0. The flaw exists in the query_geracao_auto.php component, where the 'query' parameter fails to properly sanitize user input, allowing malicious SQL code execution. Published on January 17, 2025, it carries a CVSS v3.1 base score of 9.8, reflecting its critical severity.
Remote attackers require no privileges, authentication, or user interaction to exploit this vulnerability over the network with low complexity. Successful exploitation grants high-impact access to confidentiality, integrity, and availability, enabling attackers to extract sensitive data, modify database contents, or disrupt services.
Mitigation guidance is available in the referenced advisories, including vulnerability research at https://github.com/nmmorette/vulnerability-research/tree/main/CVE-2024-57034 and the WeGIA project site at https://www.wegia.org. WeGIA versions 3.2.0 and later address the issue.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
SQL injection vulnerability in public-facing web application WeGIA < 3.2.0 enables exploitation of public-facing applications.