CVE-2024-50584

Summary

CVE-2024-50584 is a new SQL injection vulnerability that affects systems with the "Poweruser" role or user. By accessing the /class/template_io.php file and supplying malicious GET parameters, an attacker can inject SQL syntax into the JSON syntax of the "templates" parameter, leading to blind boolean-based SQL injection attacks. Successful exploitation of this vulnerability could allow the attacker to access sensitive data or execute arbitrary SQL commands. Users are advised to update their systems and apply necessary security patches to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.