Lucene search

MitreCVE-2024-44430

HistorySep 13, 2024 - 8:15 p.m.

CVE-2024-44430

2024-09-1320:15:02

CWE-94

CWE-89

mitre

web.nvd.nist.gov

sql injection

law office management

arbitrary code

sensitive information

crafted payload

kortex lite.

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

8.2

Confidence

High

EPSS

0.001

Percentile

48.3%

JSON

SQL Injection vulnerability in Best Free Law Office Management Software-v1.0 allows an attacker to execute arbitrary code and obtain sensitive information via a crafted payload to the kortex_lite/control/register_case.php interface

Affected configurations

Nvd

Node

mayurikbest_free_law_office_managementMatch1.0

VendorProductVersionCPE
mayurikbest_free_law_office_management1.0cpe:2.3:a:mayurik:best_free_law_office_management:1.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
mayurik	best_free_law_office_management	1.0	cpe:2.3:a:mayurik:best_free_law_office_management:1.0:::::::*

References

blog.csdn.net/samwbs/article/details/140954482

github.com/samwbs/kortexcve/blob/main/xss_register_case/XSS_register_case.md

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

8.2

Confidence

High

EPSS

0.001

Percentile

48.3%

JSON

Related for CVE-2024-44430