High severity · published Aug 30, 2024
CVE-2024-8329
Gether Technology 6SHR System - SQL Injection
8.8
CVSS
0.6%
EPSS
No
On KEV
Description
6SHR system from Gether Technology does not properly validate the specific page parameter, allowing remote attackers with regular privilege to inject SQL command to read, modify, and delete database contents.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 48% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
6S
6SHR System · Gether Technology
0 · source: vendor, NVD
6S
6shr · Gethertechnology
0 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-8329
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-8329
Vendor Advisory
https://www.twcert.org.tw/en/cp-139-8034-657b7-2.html
Vendor Advisory
https://www.twcert.org.tw/tw/cp-132-8030-e2eac-1.html
More from 6SHR System
8.8
CVE-2024-8330
Gether Technology 6SHR System - Unrestricted File Upload