CVE-2024-57775

HighPublic PoC

Published: 16 January 2025

Published

16 January 2025

Modified

31 January 2025

KEV Added

—

Patch

—

CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0022 44.1th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-57775 is a high-severity SQL Injection (CWE-89) vulnerability in Jfinaloa Project Jfinaloa. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Databases (T1213.006); ranked at the 44.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Databases (T1213.006). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

SI-10 directly prevents SQL injection by requiring validation of untrusted inputs like the 'insid' parameter in the getWorkFlowHis component.

SI-2 Flaw Remediation good match

prevent

SI-2 ensures timely patching of known flaws, such as updating JFinalOA to v2025.01.01 or later to remediate this SQL injection vulnerability.

RA-5 Vulnerability Monitoring and Scanning partial match

detect

RA-5 detects SQL injection vulnerabilities like CVE-2024-57775 through regular monitoring and scanning of web application components.

MITRE ATT&CK Enterprise TechniquesAI

T1213.006 Databases Collection

Adversaries may leverage databases to mine valuable information.

attack.mitre.org →

Why these techniques?

The SQL injection vulnerability in the getWorkFlowHis endpoint allows arbitrary SQL queries on the application's database, enabling adversaries to collect data from databases.

NVD Description

JFinalOA before v2025.01.01 was discovered to contain a SQL injection vulnerability via the component getWorkFlowHis?insid.

Deeper analysisAI

CVE-2024-57775 is a SQL injection vulnerability (CWE-89) affecting JFinalOA versions prior to v2025.01.01. The issue resides in the getWorkFlowHis?insid component, allowing malicious SQL queries to be injected and executed.

The vulnerability has a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating it is exploitable remotely over the network with low attack complexity and no user interaction required. Exploitation requires low privileges (PR:L), such as an authenticated user account, enabling attackers to achieve high impacts on confidentiality, integrity, and availability, potentially leading to unauthorized data access, modification, or disruption.

Mitigation details are available in the referenced advisory at https://gitee.com/r1bbit/JFinalOA/issues/IBHURT.