SQL Injection Vulnerability in ESAFENET CDG by ESAFENET

CVE-2024-10278

Summary

A SQL injection vulnerability has been identified in ESAFENET CDG 5, specifically within the ReUserOrganiseService.java file. This security flaw arises from the manipulation of the userId argument, potentially allowing an attacker to execute arbitrary SQL queries against the underlying database. The exploit can be executed remotely, increasing its risk factor. As public disclosure has occurred, organizations using this software are urged to evaluate their security posture and implement appropriate mitigations to safeguard sensitive data. Early notifications were sent to the vendor; however, a response was not received, demanding urgent attention from users of the affected product to address this security threat.

References