CVE-2024-8302

Summary

CVE-2024-8302 is a critical vulnerability affecting dingfanzu CMS versions up to commit 29d67d9044f6f93378e6eb6ff92272217ff7225c, specifically in the /ajax/chpwd.php file. This vulnerability allows for SQL injection through manipulation of the username argument, which can be exploited remotely. Remediation steps are not clearly outlined due to continuous delivery practices by the vendor, who has not responded to inquiries regarding this issue. The potential danger posed includes unauthorized access to sensitive data, as the attack complexity is low and does not require user interaction. The CVSS score for this vulnerability is 6.3, indicating medium severity with partial impacts on confidentiality and integrity.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.