CVE-2024-35563

CriticalCVSS 9.8

Published: 28/05/2024(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.42%

34th percentile - higher than 34% of all known CVEs

Summary

A SQL injection vulnerability was discovered in CDG-Server version 5.6.2.126.139 and earlier via the permissionId parameter in CDGTempPermissions. An attacker can exploit this flaw to gain unauthorized access to the database.

Risk Assessment

The risk includes potential leakage of sensitive data, modification or deletion of database records, leading to a breach of confidentiality and integrity of the system.

Recommendation

It is recommended to immediately upgrade CDG-Server to a version later than 5.6.2.126.139 and implement input validation for the permissionId parameter.

Original NVD description (English source)

CDG-Server-V5.6.2.126.139 and earlier was discovered to contain a SQL injection vulnerability via the permissionId parameter in CDGTempPermissions.