CVE-2024-5356

Deeper analysis

A vulnerability classified as critical was found in anji-plus AJ-Report versions up to 1.4.1. It is an SQL injection issue (CWE-89) affecting an unknown function in the file /dataSet/testTransform;swagger-ui, where manipulation of the dynSentence argument enables the flaw. The issue can be triggered remotely and carries a CVSS 4.0 score of 5.3 reflecting limited impacts on confidentiality, integrity, and availability when exploited by an authenticated user.

An attacker with low privileges can send a crafted request to the affected endpoint and execute arbitrary SQL statements against the backend database. Publicly disclosed proof-of-concept material demonstrates that the attack requires no user interaction and can be launched over the network, potentially allowing data exfiltration or modification within the scope of the application's database permissions.

The listed references consist of a GitHub issue thread, an attached proof-of-concept PDF, and Vuldb entries that document the flaw and the availability of exploit code; none of the sources describe vendor patches, configuration workarounds, or other mitigation steps. The associated EPSS score reached a modest peak of 0.0634 before receding to its current value of 0.0418, indicating limited and transient public exploitation interest after disclosure.