SQL Injection Risk in ESAFENET CDG Products
CVE-2024-10133

8.8HIGH

Key Information:

Vendor: Esafenet
Status: Cdg
Vendor: CVE Published:; 19 October 2024

Badges

👾 Exploit Exists🟡 Public PoC

Summary

A critical security flaw has been identified in ESAFENET CDG 5 that poses a significant SQL injection risk. Specifically, the vulnerability lies within the function updateNetSecPolicyPriority located in the /com/esafenet/servlet/ajax/NetSecPolicyAjax.java file. Attackers can exploit this weakness by manipulating input parameters such as id or frontId, which may allow unauthorized access to the database and lead to potential data breaches. Since the exploit can be executed remotely, it increases the urgency for immediate remediation. Although the vendor was notified of the issue, a response has not been received, raising concerns regarding prompt patching and user safety.

Affected Version(s)

CDG 5

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2024-10133 - Proof of Concept