Cyber Resilience

CVE-2024-7188

MediumPublic PoC

Published: 29 July 2024

Published
29 July 2024
Modified
21 November 2024
KEV Added
Patch
CVSS Score v4 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.8622 99.4th percentile
Risk Priority 66 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-7188 is a medium-severity SQL Injection (CWE-89) vulnerability in Bylancer Quicklancer. Its CVSS base score is 6.9 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 0.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

CVE-2024-7188 is a SQL injection vulnerability rated critical in Bylancer Quicklancer 2.4. It resides in unknown processing of the /listing component's GET Parameter Handler, where manipulation of the range2 argument enables the flaw, assigned CWE-89 and tracked as VDB-272609.

The issue can be exploited remotely by unauthenticated attackers who supply crafted input to the affected parameter, allowing them to execute arbitrary SQL commands against the backend database and potentially read, modify, or delete data.

Public references, including a detailed disclosure on GitHub and multiple Vuldb entries, contain no information on vendor patches or mitigation steps; the vendor was contacted prior to disclosure but provided no response.

The associated EPSS score stands at 0.8622 with a recorded peak of 0.8782, and a working exploit has already been published.

EU & UK References

Vulnerability details

A vulnerability was found in Bylancer Quicklancer 2.4. It has been rated as critical. This issue affects some unknown processing of the file /listing of the component GET Parameter Handler. The manipulation of the argument range2 leads to sql injection.…

more

The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-272609 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1505 Server Software Component Persistence
Adversaries may abuse legitimate extensible development features of servers to establish persistent access to systems.
Why these techniques?

SQL injection in public-facing web application (/listing?range2) enables exploitation of public-facing applications (T1190) and abuse of server software components via arbitrary SQL query execution (T1505), as noted in advisories.

Affected Assets

bylancer
quicklancer
2.4

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-89

Penetration testing uses SQL injection payloads against database interfaces, identifying and supporting fixes for SQL injection weaknesses.

addresses: CWE-89

Validates query inputs to prevent SQL syntax or command manipulation.

References