SQL Injection Vulnerability in Idiot Pro Version 28 Could Leak Sensitive Data

CVE-2024-8749

Summary

A SQL injection vulnerability is present in i-doit Pro version 28. This issue arises when an attacker sends specially crafted queries to the ID parameter located in the isys_api_model_cmdb_objects_by_relation.class.php file. Exploiting this flaw can enable an attacker to access and retrieve sensitive information stored in the database, potentially compromising the integrity and confidentiality of the data. It is crucial for organizations using this platform to implement effective security measures to mitigate the risks associated with this vulnerability.

References