CVE-2024-29275
Published: 22 March 2024
Summary
CVE-2024-29275 is a critical-severity SQL Injection (CWE-89) vulnerability in Seacms Seacms. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 1.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
SeaCMS version 12.9 is affected by a SQL injection vulnerability (CWE-89) located in class.php. The flaw is triggered by unsanitized input to the id parameter and carries a CVSS 3.1 score of 9.8, reflecting network-accessible attack conditions that require no authentication or user interaction.
Unauthenticated remote attackers can supply crafted input to the vulnerable parameter and thereby execute arbitrary code or retrieve sensitive data from the underlying database. The reported exploitation probability (EPSS) stands at 0.6798 with no material change from its observed peak.
Public references consist of GitHub issue reports for the seacms-net/CMS project; these do not describe available patches or explicit mitigation steps.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-26287
Vulnerability details
SQL injection vulnerability in SeaCMS version 12.9, allows remote unauthenticated attackers to execute arbitrary code and obtain sensitive information via the id parameter in class.php.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.