SQL Injection Vulnerability in ESAFENET CDG
CVE-2024-10277

9.8CRITICAL

Key Information:

Vendor
Esafenet
Status
Cdg
Vendor
CVE Published:
23 October 2024

Badges

👾 Exploit Exists🟡 Public PoC

Summary

A serious SQL injection vulnerability exists in ESAFENET CDG version 5, specifically within the /com/esafenet/servlet/ajax/UsbKeyAjax.java file. This flaw arises from improper validation of input parameters, allowing attackers to manipulate the 'id' parameter and execute arbitrary SQL commands. The vulnerability can be exploited remotely, making it critical for organizations using ESAFENET CDG to assess their security posture and implement safeguards. Despite early disclosure attempts to the vendor, no response has been received, underscoring the urgency for users to take protective actions, such as applying any available patches or seeking workarounds to mitigate this risk.

Affected Version(s)

CDG 5

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2024-10277 - Proof of Concept

References

https://vuldb.com/?id.281552
vdb-entrytechnical-description
https://vuldb.com/?ctiid.281552
signaturepermissions-required
https://vuldb.com/?submit.423830
third-party-advisory

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

0menc (VulDB User)
.