CVE-2024-57238
Published: 03 February 2025
Summary
CVE-2024-57238 is a high-severity SQL Injection (CWE-89) vulnerability in Substack (inferred from references). Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 17.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2024-57238 is a SQL injection vulnerability (CWE-89) affecting the Prolink 4G LTE Mobile Wi-Fi DL-7203E running firmware version V4.0.0B05. The flaw resides in the /reqproc/proc_get endpoint, where the order_by parameter fails to properly sanitize user input, allowing attackers to inject malicious SQL code and manipulate underlying database queries. Published on 2025-02-03, it carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), classifying it as high severity due to its network accessibility and ease of exploitation.
An unauthenticated attacker with network access to the device can exploit this vulnerability remotely with low complexity and no user interaction required. By crafting payloads for the order_by parameter, they can alter SQL queries, potentially leading to unauthorized data access, modification, or limited denial of service, though impacts on confidentiality, integrity, and availability are rated low.
Mitigation details are available in the referenced advisory at https://harryha.substack.com/p/4g-lte-mobile-wifi-dl7203e-sqli-cve-2024-57238 and the product page at https://prolink2u.com/products/dl-7203e-b. Security practitioners should consult these sources for any vendor guidance on patches or workarounds, as no specific remediation is detailed in the CVE description.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-53553
Vulnerability details
Prolink 4G LTE Mobile Wi-Fi DL-7203E V4.0.0B05 is vulnerable to SQL Injection in in the /reqproc/proc_get endpoint. The vulnerability allows an attacker to manipulate SQL queries by injecting malicious SQL code into the order_by parameter.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in unauthenticated public web endpoint (/reqproc/proc_get) directly enables remote exploitation of a network-accessible application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of user inputs like the order_by parameter to prevent SQL injection attacks.
Mandates timely identification, reporting, and correction of flaws such as this SQL injection vulnerability through patching or remediation.
Restricts information inputs to the system, such as limiting the order_by parameter to whitelisted values, reducing SQL injection risk.