CVE-2024-4307
SQL injection vulnerability in HubBank
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
SQL injection vulnerability in HubBank
| Assigner | INCIBE |
| Reserved | 2024-04-29 |
| Published | 2024-04-29 |
| Updated | 2024-08-01 |
SQL injection vulnerability in HubBank affecting version 1.0.2. This vulnerability could allow an attacker to send a specially crafted SQL query to the database through different endpoints (/accounts/activities.php?id=1, /accounts/view-deposit.php?id=1, /accounts/view_cards. php?id=1, /accounts/wire-transfer.php?id=1 and /accounts/wiretransfer-pending.php?id=1, id parameter) and retrieve the information stored in the database.
| CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
David Utón Amaya (m3n0sd0n4ld)
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-hubbank
