CVE-2024-34334
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
A SQL injection vulnerability was discovered in the forgot password function of ORDAT FOSS-Online before version 2.24.01. Attackers can exploit this flaw to manipulate database queries.
Risk Assessment
The risk includes unauthorized access to user data, including passwords, and potential account takeover. This could compromise the confidentiality and integrity of the system.
Recommendation
Immediately update ORDAT FOSS-Online to version 2.24.01 or later. Additionally, implement input validation in the forgot password function.
Other vulnerabilities in ORDAT FOSS-Online
See all- CVE-2024-34336Medium
User enumeration vulnerability in ORDAT FOSS-Online before v2.24.01 allows attackers to determine if an account exists by comparing server responses from the forgot password functionality.
- CVE-2024-34335Medium
ORDAT FOSS-Online before version 2.24.01 was discovered to contain a reflected XSS vulnerability on the login page. An attacker can inject malicious script via a crafted request.
Original NVD description (English source)
ORDAT FOSS-Online before v2.24.01 was discovered to contain a SQL injection vulnerability via the forgot password function.