Vulnerability · Published Nov 12, 2024 · Assigned by GitHub_M

CVE-2024-43415Decidim-Awesome: SQL injection in AdminAccountability

Critical 9.0

In plain English

A critical-severity SQL injection in decidim-module-decidim_awesome from decidim-ice. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.0Critical

Exploit odds (30 days)0.7%top 47.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

An improper neutralization of special elements used in an SQL command in the papertrail/version- model of the decidim_awesome-module <= v0.11.1 (> 0.9.0) allows an authenticated admin user to manipulate sql queries to disclose information, read and write files or execute commands.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
RubyGems	decidim-decidim_awesome	0.10.3	GHSA-cxwf-qc32-375f
RubyGems	decidim-decidim_awesome	0.11.2	GHSA-cxwf-qc32-375f

Affected products (as reported)

Vendor	Product	Versions
decidim-ice	decidim-module-decidim_awesome	>= 0.9.1, < 0.10.3>= 0.11.0, < 0.11.2

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L

References

https://github.com/decidim-ice/decidim-module-decidim_awesome/security/advisories/GHSA-cxwf-qc32-375f x_refsource_CONFIRM
https://github.com/decidim-ice/decidim-module-decidim_awesome/commit/84374037d34a3ac80dc18406834169c65869f11b x_refsource_MISC
https://pentest.ait.ac.at/security-advisory/decidim-awesome-sql-injection-in-adminaccountability x_refsource_MISC