Vulnerability · Published Oct 15, 2024 · Assigned by INCIBE
CVE-2024-9925SQL injection in QPLANT by TAI Smart Factory
Critical 9.8
In plain English
A critical-severity SQL injection in QPLANT SF from TAI Smart Factory. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)0.5%top 54.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
SQL injection vulnerability in TAI Smart Factory's QPLANT SF version 1.0. Exploitation of this vulnerability could allow a remote attacker to retrieve all database information by sending a specially crafted SQL query to the ‘email’ parameter on the ‘RequestPasswordChange’ endpoint.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| TAI Smart Factory | QPLANT SF | 1.0 |
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H