SQL injection vulnerabilities in SportsNET affecting version 4.0.1. These vulnerabilities could allow an attacker to retrieve, update and delete all information in the database by sending a specially crafted SQL query:  https://XXXXXXX.saludydesafio.com/app/ax/consejoRandom/ , parameter idCat;.
History

Fri, 06 Sep 2024 17:30:00 +0000

Type Values Removed Values Added
First Time appeared Sportsnet sportsnetcms
CPEs cpe:2.3:a:sportsnet:sportsnetcms:4.0.1:*:*:*:*:*:*:*
Vendors & Products Sportsnet sportsnetcms
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


Fri, 30 Aug 2024 16:15:00 +0000

Type Values Removed Values Added
First Time appeared Sportsnet
Sportsnet sportsnet
CPEs cpe:2.3:a:sportsnet:sportsnet:4.0.1:*:*:*:*:*:*:*
Vendors & Products Sportsnet
Sportsnet sportsnet

Thu, 29 Aug 2024 09:30:00 +0000

Type Values Removed Values Added
Description SQL injection vulnerabilities in SportsNET affecting version 4.0.1. These vulnerabilities could allow an attacker to retrieve, update and delete all information in the database by sending a specially crafted SQL query:  https://XXXXXXX.saludydesafio.com/app/ax/consejoRandom/ , parameter idCat;.
Title Multiple vulnerabilities in SportsNET
Weaknesses CWE-89
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}


cve-icon MITRE

Status: PUBLISHED

Assigner: INCIBE

Published: 2024-08-29T09:28:38.872Z

Updated: 2024-09-06T16:21:17.933Z

Reserved: 2024-03-19T07:42:30.141Z

Link: CVE-2024-29730

cve-icon Vulnrichment

Updated: 2024-08-29T12:59:50.984Z

cve-icon NVD

Status : Analyzed

Published: 2024-08-29T11:15:25.547

Modified: 2024-08-30T15:49:36.833

Link: CVE-2024-29730

cve-icon Redhat

No data.