CVE-2024-57765
Published: 15 January 2025
Summary
CVE-2024-57765 is a high-severity SQL Injection (CWE-89) vulnerability in Wangl1989 Mysiteforme. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Databases (T1213.006); ranked at the 43.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents SQL injection attacks like CVE-2024-57765 by enforcing validation of untrusted inputs such as the s_name parameter before database queries.
Mandates timely flaw remediation, including patching or upgrading MSFM to version 2025.01.01 or later to eliminate the specific SQL injection vulnerability.
Facilitates detection of SQL injection exploitation through continuous monitoring of database queries and anomalous access patterns resulting in unauthorized data disclosure.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The SQL injection vulnerability in the backend admin interface (s_name parameter) allows arbitrary database queries, enabling adversaries to collect data from databases.
NVD Description
MSFM before 2025.01.01 was discovered to contain a SQL injection vulnerability via the s_name parameter at table/list.
Deeper analysisAI
CVE-2024-57765 is a SQL injection vulnerability (CWE-89) affecting MSFM versions prior to 2025.01.01. The issue arises via the s_name parameter in the table/list endpoint, allowing malicious SQL payloads to be injected and executed.
The vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating it can be exploited remotely by unauthenticated attackers with low complexity and no user interaction. Successful exploitation enables high confidentiality impact, such as unauthorized access to sensitive database contents.
Advisories and additional details are available at https://gitee.com/wanglingxiao/mysiteforme/issues/IBFVK9. Mitigation involves upgrading to MSFM 2025.01.01 or later.
Details
- CWE(s)