CVE-2024-8329
Gether Technology 6SHR System - SQL Injection
- State
- Published
- Severity
- 8.8 High
- Published
- Aug 30, 2024
- Updated
- Aug 30, 2024
- Reserved
- Aug 30, 2024
Description
6SHR system from Gether Technology does not properly validate the specific page parameter, allowing remote attackers with regular privilege to inject SQL command to read, modify, and delete database contents.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 8.8 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | twcert |
Weaknesses
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected Products
| Product | Versions |
|---|---|
6SHR SystemGether Technology |
|
References
- https://www.twcert.org.tw/tw/cp-132-8030-e2eac-1.htmlthird-party-advisory
- https://www.twcert.org.tw/en/cp-139-8034-657b7-2.htmlthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.