SQL Injection Vulnerability in ContiNew Admin Products

CVE-2024-8155

Summary

A critical vulnerability exists in ContiNew Admin version 3.2.0 that allows for SQL injection via manipulated API parameters. Specifically, the flaw lies in the BaseController's tree function, which processes the '/api/system/dept/tree?sort=parentId%2Casc&sort=sort%2Casc' endpoint without adequate validation of input. This security risk enables attackers to exploit the vulnerability remotely, potentially leading to unauthorized access to sensitive information or modification of the database. Despite early notification of the flaw, the vendor has not responded adequately, raising concerns about the responsiveness of their security practices. Organizations using this product are strongly advised to implement immediate remediation measures to safeguard against potential exploitation.

References