CVE-2024-52335 SQL injection in syngo.plaza VB30E
An attacker with application access can execute malicious SQL commands to compromise the database due to improper input sanitization.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-52335?
CVE-2024-52335 is a critical SQL injection vulnerability in Siemens syngo.plaza VB30E, published on 6 Dec 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability has been identified in syngo.plaza VB30E (All versions < VB30E_HF05). The affected application do not properly sanitize input data before sending it to the SQL server. This could allow an attacker with access to the application could use this vulnerability to execute malicious SQL commands to compromise the whole database.
Weakness: CWE-89
Which versions are affected by CVE-2024-52335?
How do I fix CVE-2024-52335?
No fix has been published for CVE-2024-52335 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2024-52335 being exploited?
There is no known exploitation of CVE-2024-52335 in the wild and no public exploit code.
Sources
Also known as GHSA-mj32-rr2c-j468.