CVE-2024-27718
Published: 05 March 2024
Summary
CVE-2024-27718 is a high-severity SQL Injection (CWE-89) vulnerability. Its CVSS base score is 7.8 (High).
Operationally, ranked in the top 8.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2024-27718 is a SQL injection vulnerability in Baizhuo Network Smart s200 Management Platform version S200 that resides in the /importexport.php component. The flaw is tracked under CWE-89 and carries a CVSS 3.1 score of 7.8, reflecting local attack vector, low complexity, and low privileges required.
A local attacker can supply crafted input to the affected endpoint to extract sensitive information from the database and escalate privileges to achieve full control over confidentiality, integrity, and availability of the platform.
Public references consist of a GitHub repository that documents the injection vector; no vendor advisory, patch information, or mitigation steps are included. The EPSS score has remained flat at 0.0631 with no material rise since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-24912
Vulnerability details
SQL Injection vulnerability in Baizhuo Network Smart s200 Management Platform v.S200 allows a local attacker to obtain sensitive information and escalate privileges via the /importexport.php component.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.