Cyber Resilience

CVE-2024-12097

CriticalUpdated

Published: 05 March 2025

Published
05 March 2025
Modified
02 June 2026
KEV Added
—
Patch
—
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0011 29.7th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-12097 is a critical-severity SQL Injection (CWE-89) vulnerability in Gov (inferred from references). Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 29.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2024-12097 is an SQL Injection vulnerability (CWE-89), stemming from improper neutralization of special elements used in an SQL command. It affects Boceksoft Informatics E-Travel versions prior to 15.12.2024.

The vulnerability has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating it is exploitable over the network with low complexity, requiring no privileges or user interaction, and can result in high impacts to confidentiality, integrity, and availability. Remote attackers without authentication can inject malicious SQL queries to potentially extract sensitive data, modify database contents, or disrupt service.

Mitigation involves upgrading to E-Travel version 15.12.2024 or later. Additional details are available in the advisory at https://www.usom.gov.tr/bildirim/tr-25-0053.

EU & UK References

Vulnerability details

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Boceksoft Informatics E-Travel allows SQL Injection. This issue affects E-Travel: before 15.12.2024.

CWE(s)
CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

SQL injection in a network-accessible web application with no authentication required directly enables remote exploitation of public-facing applications.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-39334Shared CWE-89
CVE-2024-13488Shared CWE-89
CVE-2026-20002Shared CWE-89
CVE-2025-1446Shared CWE-89
CVE-2025-22699Shared CWE-89
CVE-2026-36232Shared CWE-89
CVE-2026-31871Shared CWE-89
CVE-2026-33078Shared CWE-89
CVE-2026-46359Shared CWE-89
CVE-2025-22691Shared CWE-89

Affected Assets

Gov
—
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly requires validation and sanitization of untrusted input before it is used in SQL statements, which is the precise failure that enables CVE-2024-12097.

SI-2 Flaw Remediation good match
prevent

Mandates timely application of vendor patches; the only official fix for this CVE is upgrading E-Travel to version 15.12.2024 or later.

SI-4 System Monitoring partial match
detect

Requires continuous monitoring of system and application behavior that can identify anomalous SQL queries or database errors indicative of injection attempts.

References