CVE-2024-46532
Published: 11 October 2024
Summary
CVE-2024-46532 is a critical-severity SQL Injection (CWE-89) vulnerability in Openhis (inferred from references). Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 11.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2024-46532 is a SQL injection vulnerability in OpenHIS version 1.0 that resides in the refund function of the PayController.class.php component. The flaw, tracked under CWE-89, permits unauthenticated remote attackers to supply crafted input that alters SQL queries, resulting in arbitrary code execution. It carries a CVSS 3.1 base score of 9.8, reflecting network attack vector, low complexity, and no required privileges or user interaction.
An attacker with network access can directly target the refund endpoint to inject malicious SQL statements, enabling full compromise of the affected database and application server. Successful exploitation grants complete control over confidentiality, integrity, and availability of the system without authentication.
No mitigation guidance or patch details are provided in the referenced project site or repository links. The associated EPSS score remains low, reaching a modest peak of 0.0535 before receding to its current value of 0.0422.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-41864
Vulnerability details
SQL Injection vulnerability in OpenHIS v.1.0 allows an attacker to execute arbitrary code via the refund function in the PayController.class.php component.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.