Vulnerability · Published Feb 15, 2024 · Assigned by twcert

CVE-2024-26262EBM Technologies Uniweb/SoliPACS WebServer - SQL Injection

High 8.8

In plain English

A high-severity SQL injection in Uniweb/SoliPACS WebServer from EBM Technologies. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.8%top 44.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

EBM Technologies Uniweb/SoliPACS WebServer's query functionality lacks proper restrictions of user input, allowing remote attackers authenticated as regular user to inject SQL commands for reading, modifying, and deleting database records, as well as executing system commands. Attackers may even leverage the dbo privilege in the database for privilege escalation, elevating their privileges to administrator .

Affected products (as reported)

Vendor	Product	Versions
EBM Technologies	Uniweb/SoliPACS WebServer	– before 12.1.2504

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://www.twcert.org.tw/tw/cp-132-7674-bdb40-1.html third-party-advisory