CVE-2024-27718

Vulnerability

Details A SQL injection vulnerability exists in the /importexport.php component of Baizhuo Network Smart s200 Management Platform version S200. The endpoint fails to properly sanitize user-supplied input, allowing an attacker to inject arbitrary SQL commands into the database query [1].

Exploitation

To exploit this vulnerability, an attacker must have local access to the web application. By crafting a malicious input to the vulnerable parameter, the attacker can execute arbitrary SQL statements. The attack does not require high privileges, as the vulnerability is exposed through a web interface accessible to authenticated users.

Impact

Successful exploitation can lead to unauthorized disclosure of sensitive information stored in the database, such as user credentials and configuration data. Additionally, the attacker may escalate privileges within the application, potentially gaining administrative control.

Mitigation

As of the publication date, no official patch or workaround has been provided by Baizhuo Network. Users are advised to limit network exposure to the management platform and implement strict input validation and parameterized queries as a temporary measure.