Vulnerability · Published Oct 15, 2024 · Assigned by twcert
CVE-2024-9968NewType WebEIP v3.0 - SQL injection
High 8.8
In plain English
A high-severity SQL injection in WebEIP from NewType. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.6%top 48.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
WebEIP v3.0 from NewType does not properly validate user input, allowing remote attackers with regular privilege to inject SQL commands to read, modify, and delete data stored in database. The affected product is no longer maintained. It is recommended to upgrade to the new product.
Affected products (as reported)
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://www.twcert.org.tw/tw/cp-132-8132-160bb-1.html third-party-advisory
- https://www.twcert.org.tw/en/cp-139-8133-2cc3a-2.html third-party-advisory