CVE-2024-48259
published 2024-10-14CVE-2024-48259: Cloudlog 2.6.15 allows Oqrs.php request_form SQL injection via station_id or callsign.
PriorityP351high7.3CVSS 3.1
AVNACLPRNUINSUCLILAL
EXPLOIT
EPSS
0.86%
54.0th percentile
Cloudlog 2.6.15 allows Oqrs.php request_form SQL injection via station_id or callsign.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| magicbug | cloudlog | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Nuclei
Cloudlog - SQL Injection
nuclei·CVSS 7.3
CVE-2024-48259 [HIGH] Cloudlog - SQL Injection
Cloudlog - SQL Injection
Cloudlog 2.6.15 contains a SQL injection caused by unsanitized input in oqrs.php request_form, letting attackers execute arbitrary SQL commands via station_id or callsign, exploit requires sending crafted request.
Template:
id: CVE-2024-48259
info:
name: Cloudlog - SQL Injection
author: s4e-io
severity: high
description: |
Cloudlog 2.6.15 contains a SQL injection caused by unsanitized input in oqrs.php request_form, letting attackers execute arbitrary SQL commands via station_id or callsign, exploit requires sending crafted request.
impact: |
Attackers can execute arbitrary SQL commands, potentially leading to data theft, modification, or deletion.
remediation: |
Update to the latest version of Cloudlog where this issue is fixed, or sanitize inputs properly.
re
No writeups or analysis indexed.
2024-10-14
Published