CVE-2024-29876Disclosure(sapplica / sentrifugo)

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch sapplica sentrifugo systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

SQL injection vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/reports/activitylogreport, 'sortby' parameter. The exploitation of this vulnerability could allow a remote user to send a specially crafted query to the server and extract all the data from it.

sapplica CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

Weakness type (CWE)

CWE-89

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

sentrifugo

Threat summary

Patch or workaround signal is available
1 mentions across 1 observed day

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 1 signal
Disclosure: 1 classified signal
1 total mentions across 1 day

Affected systems

Vendors

sapplica

Products

sentrifugo

1 version affected across 1 product

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Disclosure

1100.0%

Referenced assets1 URL

By indicator

https://www.valtersit.com/cve/CVE-2024-29876/

Full discourse1 post

Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters137d
Disclosure
CVE-2024-29876 - Critical SQLi in Sentrifugo 3.2. Remote extraction of all database data via sortby parameter. CVSS 9.8. Unpatched. Isolate or upgrade immediately. #CVE #infosec #Sentrifugo #CVEAlert #Linux #python #Developers More info and LABS: https://www.valtersit.com/cve/CVE-2024-29876/
Post summary
A newly disclosed critical SQL injection in Sentrifugo 3.2 (CVE-2024-29876) allows extraction of all database data via the sortby parameter; the vulnerability is unpatched, and users are urged to isolate or upgrade.
0000021
919 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	sapplica	sentrifugo	3.2	-	-

Explore more

Back to dashboard sapplica CVEs sentrifugo vulnerabilities