CVE-2024-36840
Published: 12 June 2024
Summary
CVE-2024-36840 is a critical-severity SQL Injection (CWE-89) vulnerability in Github (inferred from references). Its CVSS base score is 9.1 (Critical).
Operationally, ranked in the top 6.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CVE-2024-36840 is a SQL injection vulnerability in Boelter Blue System Management version 1.3. The flaw resides in the id parameter of news_details.php and location_details.php as well as the section parameter of services.php, enabling an attacker to manipulate database queries.
Unauthenticated remote attackers can exploit the issue over the network without user interaction. Successful exploitation yields arbitrary code execution and disclosure of sensitive information, consistent with the CVSS 9.1 rating that reflects high impact on confidentiality and integrity.
Public exploit code has been disclosed via Packet Storm and Full Disclosure mailing lists, and the EPSS score has reached a peak of 0.1253 with a current value of 0.1155. No vendor advisory or patch information appears among the referenced sources.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-36226
Vulnerability details
SQL Injection vulnerability in Boelter Blue System Management v.1.3 allows a remote attacker to execute arbitrary code and obtain sensitive information via the id parameter to news_details.php and location_details.php; and the section parameter to services.php.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.