CVE-2024-13148

CriticalUpdated

Published: 27 February 2025

Published

27 February 2025

Modified

01 June 2026

KEV Added

—

Patch

—

CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0014 34.0th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-13148 is a critical-severity SQL Injection (CWE-89) vulnerability in Gov (inferred from references). Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 34.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2024-13148 is an SQL Injection vulnerability (CWE-89), resulting from improper neutralization of special elements used in an SQL command, in the Yukseloglu Filter B2B Login Platform. This issue affects versions of the B2B Login Platform prior to 16.01.2025.

The vulnerability has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating it is exploitable remotely over the network by unauthenticated attackers with low complexity and no user interaction required. Successful exploitation allows attackers to execute arbitrary SQL commands, potentially leading to high impacts on confidentiality, integrity, and availability, such as unauthorized data access, modification, or deletion.

The USOM advisory (tr-25-0045) at https://www.usom.gov.tr/bildirim/tr-25-0045 provides further details on the vulnerability. Mitigation requires updating the B2B Login Platform to version 16.01.2025 or later.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2024-53947

Vulnerability details

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Yukseloglu Filter B2B Login Platform allows SQL Injection. This issue affects B2B Login Platform: before 16.01.2025.

CWE(s): CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

SQL Injection in a public-facing web login platform directly enables remote exploitation via T1190; arbitrary SQL execution facilitates data access/modification but maps most precisely to initial access via public app exploitation.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1