CVE-2024-57098

CriticalPublic PoC

Published: 03 February 2025

Published

03 February 2025

Modified

02 October 2025

KEV Added

—

Patch

—

CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0014 33.4th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-57098 is a critical-severity SQL Injection (CWE-89) vulnerability in Deep-Project Moss. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 33.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2024-57098 is an SQL injection vulnerability (CWE-89) in Moss version 0.1.3. The issue resides in the order parameter, where attackers can inject carefully designed payloads. Published on 2025-02-03, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical due to its potential for severe impact.

The vulnerability is exploitable remotely over the network by unauthenticated attackers with low complexity and no user interaction required. Successful exploitation grants high-level access to compromise confidentiality, integrity, and availability, potentially allowing arbitrary database manipulation, data exfiltration, or system disruption.

Mitigation details are available in the referenced GitHub issue at https://github.com/deep-project/moss/issues/13.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2024-53531

Vulnerability details

Moss v0.1.3 version has an SQL injection vulnerability that allows attackers to inject carefully designed payloads into the order parameter.

CWE(s): CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

SQL injection in a remotely accessible web application directly enables exploitation of public-facing apps (T1190) for database manipulation and data access.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1