CVE-2024-9925

Description

SQL injection vulnerability in TAI Smart Factory's QPLANT SF version 1.0. Exploitation of this vulnerability could allow a remote attacker to retrieve all database information by sending a specially crafted SQL query to the ‘email’ parameter on the ‘RequestPasswordChange’ endpoint.

Reserved 2024-10-14 | Published 2024-10-15 | Updated 2024-10-17 | Assigner INCIBE

Problem types

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Product status

Default status
unaffected

1.0
affected

Credits

Adrián Marín Villar finder

References

incibe.es/...viso-sci/sql-injection-qplant-tai-smart-factory

cve.org (CVE-2024-9925)

nvd.nist.gov (CVE-2024-9925)

Download JSON