CVE-2024-10195 | THREATINT

Description

A vulnerability was found in Tecno 4G Portable WiFi TR118 V008-20220830. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /goform/goform_get_cmd_process of the component SMS Check. The manipulation of the argument order_by leads to sql injection. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.

In Tecno 4G Portable WiFi TR118 V008-20220830 wurde eine kritische Schwachstelle ausgemacht. Hierbei betrifft es unbekannten Programmcode der Datei /goform/goform_get_cmd_process der Komponente SMS Check. Durch das Manipulieren des Arguments order_by mit unbekannten Daten kann eine sql injection-Schwachstelle ausgenutzt werden. Umgesetzt werden kann der Angriff über das Netzwerk.

Reserved 2024-10-19 | Published 2024-10-20 | Updated 2024-10-21 | Assigner VulDB

MEDIUM: 5.1CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

MEDIUM: 4.7CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

MEDIUM: 4.7CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

5.8AV:N/AC:L/Au:M/C:P/I:P/A:P

Product status

V008-20220830

affected

Timeline

2024-10-19:	Advisory disclosed
2024-10-19:	VulDB entry created
2024-10-19:	VulDB entry last update

Credits

Allan Njuguna (VulDB User) reporter

References

vuldb.com/?id.280969 (VDB-280969 | Tecno 4G Portable WiFi TR118 SMS Check goform_get_cmd_process sql injection) vdb-entry technical-description

vuldb.com/?ctiid.280969 (VDB-280969 | CTI Indicators (IOB, IOC, TTP, IOA)) signature permissions-required

vuldb.com/?submit.422994 (Submit #422994 | Tecno 4G Portable WiFi TR118 firmware version(TR118-M30E-RR-D- EnFrArSwHaPo-OP-V008-20220830) SQL Injection) third-party-advisory

asciinema.org/a/2mwkmDqRZfeAYTu5hHre1r4QB related

cve.org (CVE-2024-10195)

nvd.nist.gov (CVE-2024-10195)

Download JSON