CVE-2024-37765
Published: 01 July 2024
Summary
CVE-2024-37765 is a high-severity SQL Injection (CWE-89) vulnerability in Machform Machform. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 6.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
Machform versions up to 19 are affected by an authenticated blind SQL injection vulnerability in the user account settings page. The flaw is tracked as CVE-2024-37765, carries a CVSS 3.1 score of 8.8, and is categorized under CWE-89.
An attacker who already possesses a low-privileged account can send crafted requests over the network to the affected endpoint and extract or manipulate database contents, resulting in high impact to confidentiality, integrity, and availability without user interaction.
Public proof-of-concept code demonstrating the issue has been published on GitHub. The EPSS score has remained flat at 0.1106 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-36820
Vulnerability details
Machform up to version 19 is affected by an authenticated Blind SQL injection in the user account settings page.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Authenticated blind SQL injection in Machform web application (T1190) enables arbitrary database queries via stacked time-based techniques, facilitating collection of data from databases (T1213.006).
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.