CVE-2024-58308

CVE-2024-58308 is a SQL injection vulnerability in Quick.CMS version 6.7, affecting the login form in the administrative interface. The flaw, classified under CWE-89, enables attackers to manipulate SQL queries during authentication attempts. It has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its network accessibility, low complexity, and lack of prerequisites.

Unauthenticated remote attackers can exploit this vulnerability by submitting malicious payloads, such as ' or '1'='1, directly into the login form fields. Successful exploitation bypasses authentication entirely, granting unauthorized administrative access to the Quick.CMS system. This access could allow attackers to execute arbitrary SQL commands, potentially leading to full compromise including data exfiltration, modification, or deletion.

Advisories and references, including those from VulnCheck and Exploit-DB, detail the authentication bypass via the admin login SQL injection. An exploit is publicly available at Exploit-DB (ID 51910). The vendor's site at opensolution.org provides downloads for Quick.CMS 6.7, but no specific patch details are outlined in the provided information; practitioners should verify updates directly from the vendor.

An exploit proof-of-concept is available on Exploit-DB, indicating potential for real-world abuse against unpatched Quick.CMS 6.7 installations.