{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-8259", "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "state": "PUBLISHED", "assignerShortName": "TR-CERT", "dateReserved": "2024-08-28T09:08:16.109Z", "datePublished": "2024-12-09T13:23:06.505Z", "dateUpdated": "2024-12-13T07:16:05.030Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "product": "NatraCar B2B Dealer Management Program", "vendor": "Eryaz Information Technologies", "versions": [{"lessThanOrEqual": "09.12.2024", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Pinar TASGIN"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eryaz Information Technologies NatraCar B2B Dealer Management Program allows SQL Injection.<p>This issue affects NatraCar B2B Dealer Management Program: through 09.12.2024.<br></p><p>\nNOTE: The vendor was contacted and it was learned that the product is not supported.\n\n<br></p>"}], "value": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eryaz Information Technologies NatraCar B2B Dealer Management Program allows SQL Injection.This issue affects NatraCar B2B Dealer Management Program: through 09.12.2024.\n\n\n\nNOTE: The vendor was contacted and it was learned that the product is not supported."}], "impacts": [{"capecId": "CAPEC-66", "descriptions": [{"lang": "en", "value": "CAPEC-66 SQL Injection"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "shortName": "TR-CERT", "dateUpdated": "2024-12-13T07:16:05.030Z"}, "references": [{"url": "https://www.usom.gov.tr/bildirim/tr-24-1881"}], "source": {"advisory": "TR-24-1881", "defect": ["TR-24-1881"], "discovery": "UNKNOWN"}, "title": "Unauthenticated SQLi in Eryaz IT's NatraCar B2B Dealer Management Program", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"affected": [{"vendor": "eryaz_information_technologies", "product": "natracar_b2b_dealer_management_program", "cpes": ["cpe:2.3:a:eryaz_information_technologies:natracar_b2b_dealer_management_program:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "09.12.2024", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-12-09T15:13:10.829916Z", "id": "CVE-2024-8259", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-09T15:16:16.259Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-8259", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-12-09T15:13:10.829916Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:eryaz_information_technologies:natracar_b2b_dealer_management_program:*:*:*:*:*:*:*:*"], "vendor": "eryaz_information_technologies", "product": "natracar_b2b_dealer_management_program", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "09.12.2024"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-09T15:16:10.515Z"}}], "cna": {"title": "Unauthenticated SQLi in Eryaz IT's NatraCar B2B Dealer Management Program", "source": {"defect": ["TR-24-1881"], "advisory": "TR-24-1881", "discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Pinar TASGIN"}], "impacts": [{"capecId": "CAPEC-66", "descriptions": [{"lang": "en", "value": "CAPEC-66 SQL Injection"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Eryaz Information Technologies", "product": "NatraCar B2B Dealer Management Program", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "09.12.2024"}], "defaultStatus": "affected"}], "references": [{"url": "https://www.usom.gov.tr/bildirim/tr-24-1881"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eryaz Information Technologies NatraCar B2B Dealer Management Program allows SQL Injection.This issue affects NatraCar B2B Dealer Management Program: through 09.12.2024.\n\n\n\nNOTE: The vendor was contacted and it was learned that the product is not supported.", "supportingMedia": [{"type": "text/html", "value": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eryaz Information Technologies NatraCar B2B Dealer Management Program allows SQL Injection.<p>This issue affects NatraCar B2B Dealer Management Program: through 09.12.2024.<br></p><p>\nNOTE: The vendor was contacted and it was learned that the product is not supported.\n\n<br></p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "shortName": "TR-CERT", "dateUpdated": "2024-12-13T07:16:05.030Z"}}}, "cveMetadata": {"cveId": "CVE-2024-8259", "state": "PUBLISHED", "dateUpdated": "2024-12-13T07:16:05.030Z", "dateReserved": "2024-08-28T09:08:16.109Z", "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "datePublished": "2024-12-09T13:23:06.505Z", "assignerShortName": "TR-CERT"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eryaz Information Technologies NatraCar B2B Dealer Management Program allows SQL Injection.This issue affects NatraCar B2B Dealer Management Program: through 09.12.2024.\n\n\n\nNOTE: The vendor was contacted and it was learned that the product is not supported."}, {"lang": "es", "value": "Vulnerabilidad de neutralizaci\u00f3n inadecuada de elementos especiales utilizados en un comando SQL (\"inyecci\u00f3n SQL\") en Eryaz Information Technologies NatraCar B2B Dealer Management Program permite la inyecci\u00f3n SQL. Este problema afecta al programa de gesti\u00f3n de distribuidores B2B de NatraCar hasta el 09.12.2024. NOTA: Se contact\u00f3 al proveedor y se supo que el producto no recibe soporte."}], "id": "CVE-2024-8259", "lastModified": "2024-12-13T08:15:05.017", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "iletisim@usom.gov.tr", "type": "Primary"}]}, "published": "2024-12-09T14:15:13.473", "references": [{"source": "iletisim@usom.gov.tr", "url": "https://www.usom.gov.tr/bildirim/tr-24-1881"}], "sourceIdentifier": "iletisim@usom.gov.tr", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "iletisim@usom.gov.tr", "type": "Secondary"}]}

{}