{"id":"CVE-2024-3704","state":"PUBLISHED","title":"SQL Injection vulnerability in OpenGnsys","description":"SQL Injection Vulnerability has been found on OpenGnsys product affecting version 1.1.1d (Espeto). This vulnerability allows an attacker to inject malicious SQL code into login page to bypass it or even retrieve all the information stored in the database.","publishedAt":"2024-04-12T13:47:03.946Z","updatedAt":"2024-08-01T20:20:01.267Z","severity":{"score":9.8,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"INCIBE"},"assigner":"INCIBE","products":["OpenGnsys OpenGnsys"],"affected":[{"vendor":"OpenGnsys","product":"OpenGnsys","defaultStatus":"unaffected","versions":[{"version":"1.1.1d","status":"affected"}]}],"references":["https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-opengnsys","https://opengnsys.es/web/parche-de-seguridad-cve-2024-370x"],"weaknesses":["CWE-89"],"ingestedAt":"2026-10-29T20:07:39.287Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/3xxx/CVE-2024-3704.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-3704","state":"PUBLISHED","datePublished":"2024-04-12T13:47:03.946Z","dateUpdated":"2024-08-01T20:20:01.267Z","assignerShortName":"INCIBE","assignerOrgId":"0cbda920-cd7f-484a-8e76-bf7f4b7f4516","dateReserved":"2024-04-12T10:44:52.613Z"},"containers":{"cna":{"title":"SQL Injection vulnerability in OpenGnsys","descriptions":[{"lang":"en","value":"SQL Injection Vulnerability has been found on OpenGnsys product affecting version 1.1.1d (Espeto). This vulnerability allows an attacker to inject malicious SQL code into login page to bypass it or even retrieve all the information stored in the database."}],"affected":[{"vendor":"OpenGnsys","product":"OpenGnsys","defaultStatus":"unaffected","versions":[{"version":"1.1.1d","status":"affected"}]}],"references":[{"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-opengnsys"},{"url":"https://opengnsys.es/web/parche-de-seguridad-cve-2024-370x","tags":["patch"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-89","description":"CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"INCIBE","orgId":"0cbda920-cd7f-484a-8e76-bf7f4b7f4516","dateUpdated":"2024-07-05T12:44:44.802Z"},"credits":[{"lang":"en","type":"finder","value":"Pedro Gabaldón Julá"},{"lang":"en","type":"finder","value":"Javier Medina Munuera"},{"lang":"en","type":"finder","value":"Antonio José Gálvez Sánchez"}],"datePublic":"2024-04-12T10:00:00.000Z","solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"The OpenGnsys development team has released a security patch that resolves the reported vulnerabilities. These fixes will be included in the next version to be released shortly."}],"value":"The OpenGnsys development team has released a security patch that resolves the reported vulnerabilities. These fixes will be included in the next version to be released shortly."}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"opengnsys","product":"opengnsys","defaultStatus":"unknown","versions":[{"version":"1.1.1d","status":"affected"}],"cpes":["cpe:2.3:a:opengnsys:opengnsys:*:*:*:*:*:*:*:*"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-06-18T19:21:20.654359Z","id":"CVE-2024-3704","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-06-18T19:22:05.117Z"}},{"title":"CVE Program Container","references":[{"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-opengnsys","tags":["x_transferred"]},{"url":"https://opengnsys.es/web/parche-de-seguridad-cve-2024-370x","tags":["patch","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-01T20:20:01.267Z"}}]}}}