Cyber Resilience

CVE-2024-45265

Critical

Published: 26 August 2024

Published
26 August 2024
Modified
05 September 2024
KEV Added
—
Patch
—
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.1758 95.2th percentile
Risk Priority 30 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-45265 is a critical-severity SQL Injection (CWE-89) vulnerability in Skyss Arfa-Cms. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 4.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

Deeper analysis

A SQL injection vulnerability exists in the poll component of SkySystem Arfa-CMS versions prior to 5.1.3124. The flaw, tracked as CVE-2024-45265, permits unsanitized input in the psid parameter to be passed directly into SQL queries, enabling execution of arbitrary commands. It carries a CVSS 3.1 score of 9.8 and is also associated with CWE-89 and CWE-79.

Unauthenticated remote attackers can exploit the issue over the network without user interaction or credentials. Successful exploitation grants full read, write, and delete access to the database, potentially leading to complete compromise of the affected application and underlying data.

The vendor addressed the flaw by releasing version 5.1.3124. Public references include a GitHub repository containing proof-of-concept material and the vendor site skyss.ru, though no additional mitigation details beyond the version update are provided in the available sources. The EPSS score has remained flat at 0.1758 with no observed rise after disclosure.

EU & UK References

Vulnerability details

A SQL injection vulnerability in the poll component in SkySystem Arfa-CMS before 5.1.3124 allows remote attackers to execute arbitrary SQL commands via the psid parameter.

CWE(s)
CWE-89CWE-79

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
T1213.006 Databases Collection
Adversaries may leverage databases to mine valuable information.
attack.mitre.org →
Why these techniques?

SQL injection vulnerability in public-facing Arfa-CMS poll component enables exploitation of public-facing applications (T1190), privilege escalation as noted in advisory (T1068), and arbitrary SQL execution facilitating data collection from databases (T1213.006).

Affected Assets

skyss
arfa-cms
≤ 5.1.3132

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

CA-8 Penetration Testing
addresses: CWE-79 CWE-89

Penetration testing submits XSS payloads to web applications, detecting cross-site scripting flaws for subsequent remediation.

SI-10 Information Input Validation
addresses: CWE-79 CWE-89

Validates web inputs to reject script-related content that could produce XSS.

SI-15 Information Output Filtering
addresses: CWE-79

Output validation against expected content can reject or sanitize script content in generated web pages, reducing XSS exploitability.

References