Cyber Resilience

CVE-2024-37765

HighPublic PoC

Published: 01 July 2024

Published
01 July 2024
Modified
30 April 2025
KEV Added
Patch
CVSS Score v3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.1106 93.6th percentile
Risk Priority 24 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-37765 is a high-severity SQL Injection (CWE-89) vulnerability in Machform Machform. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 6.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

Machform versions up to 19 are affected by an authenticated blind SQL injection vulnerability in the user account settings page. The flaw is tracked as CVE-2024-37765, carries a CVSS 3.1 score of 8.8, and is categorized under CWE-89.

An attacker who already possesses a low-privileged account can send crafted requests over the network to the affected endpoint and extract or manipulate database contents, resulting in high impact to confidentiality, integrity, and availability without user interaction.

Public proof-of-concept code demonstrating the issue has been published on GitHub. The EPSS score has remained flat at 0.1106 with no material increase since disclosure.

EU & UK References

Vulnerability details

Machform up to version 19 is affected by an authenticated Blind SQL injection in the user account settings page.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1213.006 Databases Collection
Adversaries may leverage databases to mine valuable information.
Why these techniques?

Authenticated blind SQL injection in Machform web application (T1190) enables arbitrary database queries via stacked time-based techniques, facilitating collection of data from databases (T1213.006).

Affected Assets

machform
machform
≤ 19

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-89

Penetration testing uses SQL injection payloads against database interfaces, identifying and supporting fixes for SQL injection weaknesses.

addresses: CWE-89

Validates query inputs to prevent SQL syntax or command manipulation.

References