CVE-2024-9293

Summary

CVE-2024-9293 is a critical vulnerability affecting the yylAdmin component of skyselang, specifically in versions up to 3.0, where an SQL injection can occur due to improper handling of the "is_disable" argument in the file /app/admin/controller/file/File.php. This vulnerability allows remote attackers to exploit the system without requiring user interaction or high privileges. The potential risks include unauthorized access to sensitive data, data manipulation, and system compromise due to low complexity and availability of attack vectors. Organizations using affected versions are advised to apply available patches or updates and review their security configurations to mitigate this risk. The vulnerability has been publicly disclosed, raising concerns about its exploitation in the wild.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.