Critical severity · published Apr 30, 2024
CVE-2024-33267
SQL Injection vulnerability in Hero hfheropayment v.1.2.5 and before allows an attacker to escalate privileges via the HfHeropaymentGatewayBackModuleFrontController::initContent()…
9.8
CVSS
0.5%
EPSS
No
On KEV
Description
SQL Injection vulnerability in Hero hfheropayment v.1.2.5 and before allows an attacker to escalate privileges via the HfHeropaymentGatewayBackModuleFrontController::initContent() function.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HE
Hero · Htc
before 1.25 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-33267
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-33267
security.friendsofpresta.org
https://security.friendsofpresta.org/modules/2024/04/29/hfheropayment.html
www.heropay.eu
https://www.heropay.eu/
More from Hero
–
CVE-2012-2217
The HTC IQRD service for Android on the HTC EVO 4G before 4.67.651.3, EVO Design 4G before 2.12.651.5, Shift 4G before 2.77.651.3, EVO 3D before 2.17.651.5, EVO View 4G before…