CVE-2024-24112
Published: 06 February 2024
Summary
CVE-2024-24112 is a critical-severity SQL Injection (CWE-89) vulnerability in Exrick Xmall. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 0.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
xmall version 1.1 contains a SQL injection vulnerability, tracked as CWE-89, that is triggered through the orderDir parameter. The flaw received a CVSS 3.1 score of 9.8, reflecting network-accessible attack vectors that require no authentication or user interaction and can result in complete loss of confidentiality, integrity, and availability.
Remote attackers can supply crafted input to the affected parameter and execute arbitrary SQL commands against the underlying database, enabling data exfiltration, modification, or service disruption. The associated EPSS score stands at 0.8157, indicating substantial exploitation likelihood. Public discussion of the issue appears in the referenced GitHub repository entries, though no official patches or mitigation guidance are detailed in the available references.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-21537
Vulnerability details
xmall v1.1 was discovered to contain a SQL injection vulnerability via the orderDir parameter.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.