CVE-2024-4991

Description

Vulnerability in SiAdmin 1.1 that allows SQL injection via the /modul/mod_pass/aksi_pass.php parameter in nama_lengkap. This vulnerability could allow a remote attacker to send a specially crafted SQL query to the system and retrieve all the information stored in it.

Reserved 2024-05-16 | Published 2024-05-16 | Updated 2024-08-01 | Assigner INCIBE

Problem types

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Product status

Default status
unaffected

1.1
affected

Credits

Rafael Pedrero finder

References

www.incibe.es/...ices/aviso/multiple-vulnerabilities-siadmin

cve.org (CVE-2024-4991)

nvd.nist.gov (CVE-2024-4991)

Download JSON