CVE-2024-7188
Published: 29 July 2024
Summary
CVE-2024-7188 is a medium-severity SQL Injection (CWE-89) vulnerability in Bylancer Quicklancer. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 0.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CVE-2024-7188 is a SQL injection vulnerability rated critical in Bylancer Quicklancer 2.4. It resides in unknown processing of the /listing component's GET Parameter Handler, where manipulation of the range2 argument enables the flaw, assigned CWE-89 and tracked as VDB-272609.
The issue can be exploited remotely by unauthenticated attackers who supply crafted input to the affected parameter, allowing them to execute arbitrary SQL commands against the backend database and potentially read, modify, or delete data.
Public references, including a detailed disclosure on GitHub and multiple Vuldb entries, contain no information on vendor patches or mitigation steps; the vendor was contacted prior to disclosure but provided no response.
The associated EPSS score stands at 0.8622 with a recorded peak of 0.8782, and a working exploit has already been published.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-48156
Vulnerability details
A vulnerability was found in Bylancer Quicklancer 2.4. It has been rated as critical. This issue affects some unknown processing of the file /listing of the component GET Parameter Handler. The manipulation of the argument range2 leads to sql injection.…
more
The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-272609 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing web application (/listing?range2) enables exploitation of public-facing applications (T1190) and abuse of server software components via arbitrary SQL query execution (T1505), as noted in advisories.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.