CVE-2024-8150

Summary

CVE-2024-8150 is a critical vulnerability identified in ContiNew Admin version 3.2.0, specifically affecting the API endpoint /api/system/user?deptId=1&page=1&size=10 due to improper handling of the "sort" argument, leading to SQL injection risks. This vulnerability allows for remote exploitation, which could compromise data integrity and confidentiality within affected systems. The potential danger includes unauthorized access to sensitive information and manipulation of database content, posing a significant threat to organizations using this software. Remediation steps include updating to a patched version of the software or implementing input validation to mitigate the risk of SQL injection attacks. Despite early notification, the vendor has not responded regarding this issue, raising concerns about timely support for users affected by the vulnerability.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.