SQL Injection Vulnerabilities in SportsNET's Version 4.0.1
CVE-2024-29729

9.8CRITICAL

Key Information:

Vendor

Sportsnet

Status
Sportsnet
Vendor
CVE Published:
29 August 2024

What is CVE-2024-29729?

The SQL injection vulnerabilities in SportsNET version 4.0.1 enable attackers to execute malicious SQL queries that can manipulate the database. This exploitation can lead to unauthorized access, retrieval, modification, or deletion of critical information within the system. The vulnerability arises when specially crafted SQL queries are sent through the parameter 'url' on a specific endpoint, potentially compromising the integrity and confidentiality of the data stored in the database.

Affected Version(s)

SportsNET 4.0.1

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multip...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

https://www.incibe.es/incibe-cert/alerta-temprana/avisos/multiples-vulnerabilidades-en-sportsnet
.