CVE-2024-9925

Summary

CVE-2024-9925 is a newly disclosed SQL injection vulnerability affecting TAI Smart Factory's QPLANT SF version 1.0. This issue resides in the 'RequestPasswordChange' endpoint and permits a remote attacker to manipulate SQL queries by injecting malicious code into the 'email' parameter. Successful exploitation grants unauthorized access to all database information. This vulnerability poses a significant risk, as it can facilitate data theft and potential system compromise. It is essential for users running this version to apply the necessary patches as soon as possible to mitigate this threat.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.