Cyber Resilience

CVE-2024-55517

High

Published: 08 January 2025

Published
08 January 2025
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0018 39.3th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-55517 is a high-severity SQL Injection (CWE-89) vulnerability in Hackmd (inferred from references). Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 39.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2024-55517 is a SQL injection vulnerability in the Interllect Core Search component of Polaris FT Intellect Core Banking version 9.5. The flaw arises from improper handling of user input passed through the groupType parameter in the /SCGController endpoint, which is directly incorporated into SQL queries without adequate sanitization or parameterization. This issue was publicly disclosed on January 8, 2025, and is classified under CWE-89 with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact.

The vulnerability can be exploited by any authenticated user with low privileges (PR:L) over the network (AV:N) with low attack complexity and no user interaction required. Successful exploitation allows attackers to manipulate SQL queries, potentially leading to high confidentiality, integrity, and availability impacts, such as unauthorized data extraction, modification, or deletion from the underlying database.

Mitigation details and additional technical information are available in the advisory referenced at https://hackmd.io/@AowPhwc/SyvEiDsIye. Security practitioners should prioritize patching or input validation upgrades in affected environments, especially in financial institutions relying on this core banking software.

EU & UK References

Vulnerability details

An issue was discovered in the Interllect Core Search in Polaris FT Intellect Core Banking 9.5. Input passed through the groupType parameter in /SCGController is mishandled before being used in SQL queries, allowing SQL injection in an authenticated session.

CWE(s)
CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

SQL injection in network-accessible web endpoint (/SCGController) directly enables exploitation of the application for data manipulation and impact.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2026-39334Shared CWE-89
CVE-2024-13488Shared CWE-89
CVE-2026-20002Shared CWE-89
CVE-2025-1446Shared CWE-89
CVE-2025-22699Shared CWE-89
CVE-2026-36232Shared CWE-89
CVE-2026-31871Shared CWE-89
CVE-2026-33078Shared CWE-89
CVE-2026-46359Shared CWE-89
CVE-2025-22691Shared CWE-89

Affected Assets

Hackmd
—
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly mitigates the SQL injection by enforcing validation and sanitization of untrusted inputs like the groupType parameter before incorporation into SQL queries.

SI-2 Flaw Remediation good match
prevent

Requires timely remediation of the specific flaw in input handling within the /SCGController endpoint through patching or code upgrades.

RA-5 Vulnerability Monitoring and Scanning good match
preventdetect

Enables vulnerability scanning to identify SQL injection issues like CVE-2024-55517 in the Interllect Core Search component and prompts remediation.

References