CVE-2024-29873

Summary

CVE-2024-29873 is a newly identified SQL injection vulnerability affecting Sentrifugo 3.2. The issue lies in the "/sentrifugo/index.php/reports/businessunits/format/html" endpoint, specifically the 'bunitname' parameter. A remote attacker can exploit this flaw by delivering a maliciously crafted query, potentially granting unauthorized access to all data stored on the server. This vulnerability underscores the importance of timely software updates and input validation to secure web applications against SQL injection attacks.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.