Lucene search

TwcertVULNRICHMENT:CVE-2024-7731

HistoryAug 14, 2024 - 6:30 a.m.

CVE-2024-7731 SECOM Dr.ID Access control system - SQL injection

2024-08-1406:30:58

CWE-89

twcert

github.com

secom

dr.id

access control

sql injection

vulnerability

cve-2024-7731

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

7.9

Confidence

Low

EPSS

0.001

Percentile

39.6%

SSVC

Exploitation

none

Automatable

yes

Technical Impact

total

JSON

Dr.ID Access Control System from SECOM does not properly validate a specific page parameter, allowing unauthenticated remote attackers to inject SQL commands to read, modify, and delete database contents.

CNA Affected

[
  {
    "vendor": "SECOM",
    "product": "Dr.ID Access control  system",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "3.6.3",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:secom:dr.id_access_control:*:*:*:*:*:*:*:*"
    ],
    "vendor": "secom",
    "product": "dr.id_access_control",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "3.6.3",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

References

www.twcert.org.tw/en/cp-139-8006-036f5-2.html

www.twcert.org.tw/tw/cp-132-8005-c3c94-1.html

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

7.9

Confidence

Low

EPSS

0.001

Percentile

39.6%

SSVC

Exploitation

none

Automatable

yes

Technical Impact

total

JSON

Related for VULNRICHMENT:CVE-2024-7731