CVE-2024-57162
Published: 16 January 2025
Summary
CVE-2024-57162 is a high-severity SQL Injection (CWE-89) vulnerability in Campcodes Cybercafe Management System. Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 23.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SC-7 (Boundary Protection) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents SQL injection by validating and sanitizing user inputs to /ccms/view-user-detail.php before database query execution.
Requires timely identification, testing, and patching of the SQL injection flaw in Campcodes Cybercafe Management System v1.0.
Boundary protection via web application firewall blocks SQL injection payloads targeting the network-accessible vulnerable endpoint.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in the public-facing web application (/ccms/view-user-detail.php) enables exploitation for initial access (T1190) and arbitrary data collection from the backend database (T1213.006).
NVD Description
Campcodes Cybercafe Management System v1.0 is vulnerable to SQL Injection in /ccms/view-user-detail.php.
Deeper analysisAI
CVE-2024-57162 is an SQL Injection vulnerability (CWE-89) in Campcodes Cybercafe Management System version 1.0, specifically affecting the /ccms/view-user-detail.php component. Published on 2025-01-16, it carries a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), indicating a high-severity issue accessible over the network.
The vulnerability can be exploited by a high-privileged user (PR:H) remotely with low attack complexity and no user interaction required. Successful exploitation grants high impacts across confidentiality, integrity, and availability, enabling the attacker to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion within the application's database.
Mitigation details are outlined in the referenced advisory at https://github.com/h1-wh0areu/bug_report/blob/main/cybercafe-management-system/SQLi-1.md.
Details
- CWE(s)