CVE-2024-57098
Published: 03 February 2025
Description
Moss v0.1.3 version has an SQL injection vulnerability that allows attackers to inject carefully designed payloads into the order parameter.
Security Summary
CVE-2024-57098 is an SQL injection vulnerability (CWE-89) in Moss version 0.1.3. The issue resides in the order parameter, where attackers can inject carefully designed payloads. Published on 2025-02-03, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical due to its potential for severe impact.
The vulnerability is exploitable remotely over the network by unauthenticated attackers with low complexity and no user interaction required. Successful exploitation grants high-level access to compromise confidentiality, integrity, and availability, potentially allowing arbitrary database manipulation, data exfiltration, or system disruption.
Mitigation details are available in the referenced GitHub issue at https://github.com/deep-project/moss/issues/13.
Details
- CWE(s)