SQL Injection Vulnerability in anji-plus AJ-Report Product
CVE-2024-5350
Key Information:
Badges
What is CVE-2024-5350?
A significant SQL injection vulnerability has been identified in the anji-plus AJ-Report product, specifically within the function pageList in the file /pageList. This critical security flaw allows attackers to manipulate the argument 'p', leading to unauthorized database query execution. As this vulnerability can be exploited remotely, it poses a severe risk to system integrity and confidentiality. The affected versions include AJ-Report up to version 1.4.1. Immediate remediation is recommended to prevent potential exploitation and safeguard sensitive data. Public disclosures have increased the urgency for users to update their software to address this critical security issue.
Affected Version(s)
AJ-Report 1.4.0
AJ-Report 1.4.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
News Articles
blog.xsx.twCVE-2024-5350漏洞复现-CVE-2024-5350-XSS博客
一：漏洞名称 AJ-Report pageList sql注入漏洞 二：漏洞描述 AJ-Report 1.4.1 是一个灵活的开源工具，可轻松生成各种动态报表，并支持多种数据源。它易于集成到 Java Web 应用程序中，提供了丰富的定制选项，适用于开发人员快速创建和展示报表。 AJ-Report up to 1.4.1的漏洞已被发现，被分类为关键。受影响的是/pageList文件中的pageLi
References
CVSS V3.1
Timeline
- 📰
First article discovered by blog.xsx.tw
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved