CVE-2024-57770
Published: 16 January 2025
Description
Adversaries may leverage databases to mine valuable information.
Security Summary
CVE-2024-57770 is a SQL injection vulnerability (CWE-89) affecting JFinalOA versions prior to v2025.01.01. The issue resides in the apply/save#oaContractApply.id component, allowing malicious SQL queries to be injected and executed.
The vulnerability has a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating it is exploitable over the network with low attack complexity, requiring only low privileges, and no user interaction. An authenticated attacker with low-level access can leverage this to achieve high impacts on confidentiality, integrity, and availability, potentially enabling unauthorized data access, modification, or disruption.
Mitigation details are available in the referenced advisory at https://gitee.com/r1bbit/JFinalOA/issues/IBHUP1. Upgrading to JFinalOA v2025.01.01 or later addresses the vulnerability.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
SQL injection in authenticated admin endpoint allows arbitrary SQL execution on the backend database, facilitating data collection from databases.