CVE-2024-44541
Published: 11 September 2024
Summary
CVE-2024-44541 is a critical-severity SQL Injection (CWE-89) vulnerability. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 9.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
evilnapsis Inventio Lite versions v4 and earlier are affected by a SQL injection vulnerability (CWE-89) in the username parameter passed to the /?action=processlogin endpoint. The flaw received a CVSS 3.1 score of 9.8, reflecting network-accessible exploitation with no required authentication or user interaction and full impact on confidentiality, integrity, and availability.
An unauthenticated remote attacker can supply crafted input to the login action and execute arbitrary SQL statements against the underlying database, enabling data exfiltration, modification, or deletion that can fully compromise the application instance.
Public references consist of the project's GitHub repository and a separate proof-of-concept repository; no official advisories, patches, or mitigation steps are provided in the available information. The EPSS score has remained flat at 0.0525 since publication, indicating no material increase in observed exploitation interest.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-41040
Vulnerability details
evilnapsis Inventio Lite Versions v4 and before is vulnerable to SQL Injection via the "username" parameter in "/?action=processlogin."
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.