Cyber Resilience

CVE-2024-57665

CriticalPublic PoC

Published: 29 January 2025

Published
29 January 2025
Modified
23 May 2025
KEV Added
—
Patch
—
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0014 34.6th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-57665 is a critical-severity SQL Injection (CWE-89) vulnerability in Heyewei Jfinalcms. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 34.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2024-57665 is a SQL injection vulnerability (CWE-89) in JFinalCMS version 1.0, specifically within the file rc/main/java/com/cms/entity/Content.java. The flaw occurs because the title parameter is user-controllable and is directly concatenated into the filterSql string without any filtering or sanitization, allowing malicious SQL payloads to be injected.

The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating it is exploitable remotely over the network by unauthenticated attackers with low attack complexity and no user interaction required. Successful exploitation enables high-impact compromise of confidentiality, integrity, and availability, such as executing arbitrary SQL queries to extract, modify, or delete database contents.

Details on the vulnerability discovery, including proof-of-concept exploitation steps, are documented in the referenced GitHub repository at https://github.com/Nbccccc/vulnerability_discovery/blob/main/JFinalCMS/JFinalCms%20SQL%20Injection.md. No vendor advisories, patches, or specific mitigation guidance are detailed in the provided information.

EU & UK References

Vulnerability details

JFinalCMS 1.0 is vulnerable to SQL Injection in rc/main/java/com/cms/entity/Content.java. The cause of the vulnerability is that the title parameter is controllable and is concatenated directly into filterSql without filtering.

CWE(s)
CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1213.006 Databases Collection
Adversaries may leverage databases to mine valuable information.
attack.mitre.org →
Why these techniques?

SQL Injection in public-facing CMS enables exploitation of public-facing application (T1190) and facilitates data collection from databases via arbitrary SQL queries (T1213.006).

CVEs Like This One

CVE-2019-25537Shared CWE-89
CVE-2019-25366Shared CWE-89
CVE-2019-25496Shared CWE-89
CVE-2026-1475Shared CWE-89
CVE-2026-26990Shared CWE-89
CVE-2026-44047Shared CWE-89
CVE-2025-12865Shared CWE-89
CVE-2024-11135Shared CWE-89
CVE-2019-25491Shared CWE-89
CVE-2024-13369Shared CWE-89

Affected Assets

heyewei
jfinalcms
1.0

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly requires validating user-controllable inputs such as the title parameter to prevent SQL injection via unsanitized concatenation into filterSql.

SI-2 Flaw Remediation good match
prevent

Mandates timely identification, correction, testing, and deployment of fixes for flaws like the SQL injection in Content.java.

RA-5 Vulnerability Monitoring and Scanning good match
detect

Requires vulnerability scanning that identifies SQL injection vulnerabilities like CVE-2024-57665 for subsequent remediation.

References