SQL Injection Vulnerability in DigiWin .NET Allows Unauthorized Access to Database Records and System Commands

CVE-2024-4893

What is CVE-2024-4893?

The vulnerability present in DigiWin EasyFlow .NET arises from a lack of proper validation for specific input parameters. This oversight permits remote attackers to inject arbitrary SQL commands into the application. As a result, these unauthorized individuals can gain access to sensitive database records, jeopardizing data integrity and potentially allowing for data manipulation or deletion. Furthermore, the exploit can extend to executing system commands, amplifying the risk of server compromise. Users of this application must prioritize security measures to mitigate the risks associated with this vulnerability.

References