CVE-2024-24572

Summary

CVE-2024-24572 is a vulnerability affecting the facileManager suite of web applications, versions 4.5.0 and earlier. An authenticated user with log viewing privileges can manipulate the search_sql variable in the admin-logs.php file by appending it to a GET parameter. Although $_SESSION manipulation is prevented, other sensitive variables, including search_sql, remain unprotected. Consequently, the checks and SQL injection prevention attempts built into the application become ineffective, posing a significant security risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.