CVE-2024-38773: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Adrian Tobey FormLift for Infusionsoft Web Forms allows…

PriorityP266critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

EXPLOIT

EPSS

2.00%

78.3th percentile

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Adrian Tobey FormLift for Infusionsoft Web Forms allows Blind SQL Injection.This issue affects FormLift for Infusionsoft Web Forms: from n/a through 7.5.17.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
adrian_tobey	formlift_for_infusionsoft_web_forms	n/a – 7.5.17	—
formlift	formlift_for_infusionsoft_web_forms	< 7.5.18	7.5.18

Detection & IOCsextracted from sources · hover to see the quote

sigma

status_code == 500 AND contains(content_type, "text/html") AND version <= 7.5.17

→Blind SQL injection probe uses a single quote (') appended to the FormLift version parameter; a resulting HTTP 500 response with Content-Type text/html is a positive indicator of the vulnerability being triggered.
→Digest/signature present in the detection rule can be used to fingerprint or validate the specific nuclei/detection template: 4b0a00483046022100f4b46a81ce2fe4e8b14b7cb495694891c6c6c45189ebf424f4dfde6b8f5668f6022100acbd79d98623cd33f92af49ca93c32006b0021c9f677c362350ca7e999402b4d:922c64590222798bb761d5b6d8e72950

·Vulnerability affects FormLift for Infusionsoft Web Forms from an unspecified version through 7.5.17 only; versions above 7.5.17 are not affected per the advisory. ↗
·The SQL injection is Blind (time-based or boolean-based), meaning no direct error output is returned in normal exploitation — detection relying solely on HTTP 500 responses may miss more subtle blind injection attempts that do not trigger server errors. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.