SQL Injection Risk in MSFM Product by Vendor
CVE-2024-57765

7.5HIGH

Key Information:

Vendor

Vendor

Status
Mysiteforme
Vendor
CVE Published:
15 January 2025

What is CVE-2024-57765?

The MSFM product, prior to version 2025.01.01, is vulnerable to SQL injection. This vulnerability allows attackers to manipulate the SQL queries executed by the application through unsanitized input in the s_name parameter at the table/list endpoint. Successful exploitation could lead to unauthorized data access or data manipulation, posing a significant risk to the integrity and confidentiality of the information stored in the database.

References

https://gitee.com/wanglingxiao/mysiteforme/issues/IBFVK9

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.