CVE-2024-13194
Published: 09 January 2025
Summary
CVE-2024-13194 is a medium-severity Injection (CWE-74) vulnerability in Sucms Project Sucms. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 26.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2024-13194 is a critical SQL injection vulnerability in Sucms version 1.0. The issue affects an unknown functionality within the file /admin/admin_members.php?ac=search, where manipulation of the "uid" argument enables the injection. It is remotely exploitable and has been assigned CWEs 74 and 89, with a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
An attacker with low privileges, such as an authenticated user, can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation allows limited impacts on confidentiality, integrity, and availability, potentially enabling unauthorized data access, modification, or disruption through SQL queries.
Advisories from VulDB (ctiid.290786, id.290786, submit.469566) document the vulnerability, and a public exploit proof-of-concept is available in a GitHub repository at Upgradeextension/Sucms-v1.0SQLinjection. No patches or specific mitigation steps are detailed in the provided references.
The exploit has been publicly disclosed, increasing the risk of active exploitation against unpatched Sucms 1.0 instances.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-51416
Vulnerability details
A vulnerability was found in Sucms 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/admin_members.php?ac=search. The manipulation of the argument uid leads to sql injection. The attack may be launched remotely. The…
more
exploit has been disclosed to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in web application admin panel (Sucms 1.0 /admin/admin_members.php?ac=search uid) enables exploitation of public-facing application for initial access (T1190), abuse of server software component (T1505 as mapped in advisory), and collection of data from databases such as user/member information (T1213.006).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents SQL injection by validating the 'uid' parameter in /admin/admin_members.php?ac=search against expected syntax and semantics.
Mandates timely identification, reporting, and correction of the SQL injection flaw in Sucms 1.0 to eliminate the vulnerability.
Enables vulnerability scanning to identify SQL injection issues like CVE-2024-13194 in web applications prior to exploitation.