Search

Find a vulnerability

Search criteria

    2 vulnerabilities found for NatraCar B2B Dealer Management Program by Eryaz Information Technologies

    CVE-2024-8259 (GCVE-0-2024-8259)

    Vulnerability from nvd – Published: 2024-12-09 13:23 – Updated: 2026-06-02 08:22
    VLAI
    Title
    Unauthenticated SQLi in Eryaz IT's NatraCar B2B Dealer Management Program
    Summary
    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eryaz Information Technologies NatraCar B2B Dealer Management Program allows SQL Injection. This issue affects NatraCar B2B Dealer Management Program: through 09.12.2024. NOTE: The vendor was contacted and it was learned that the product is not supported.
    Severity
    9.8 (Critical)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    SSVC
    Exploitation: none Automatable: yes Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2024-12-09 15:13 UTC
    CWE
    • CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
    Assigner
    References
    Impacted products
    Vendor Product Version
    Eryaz Information Technologies NatraCar B2B Dealer Management Program Affected: 0 , ≤ 09.12.2024 (custom)
    		Create a notification for this product.
    eryaz_information_technologies natracar_b2b_dealer_management_program Affected: 0 , ≤ 09.12.2024 (custom)
        cpe:2.3:a:eryaz_information_technologies:natracar_b2b_dealer_management_program:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    Credits
    Pinar TASGIN
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:eryaz_information_technologies:natracar_b2b_dealer_management_program:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "natracar_b2b_dealer_management_program",
            "vendor": "eryaz_information_technologies",
            "versions": [
              {
                "lessThanOrEqual": "09.12.2024",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-8259",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-09T15:13:10.829916Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-03T19:26:35.191Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "NatraCar B2B Dealer Management Program",
          "vendor": "Eryaz Information Technologies",
          "versions": [
            {
              "lessThanOrEqual": "09.12.2024",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Pinar TASGIN"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027) vulnerability in Eryaz Information Technologies NatraCar B2B Dealer Management Program allows SQL Injection.\u003cp\u003eThis issue affects NatraCar B2B Dealer Management Program: through 09.12.2024.\u003cbr\u003e\u003c/p\u003e\u003cp\u003e\nNOTE: The vendor was contacted and it was learned that the product is not supported.\n\n\u003cbr\u003e\u003c/p\u003e"
            }
          ],
          "value": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027) vulnerability in Eryaz Information Technologies NatraCar B2B Dealer Management Program allows SQL Injection.\n\nThis issue affects NatraCar B2B Dealer Management Program: through 09.12.2024.\n\n\n\n\n\nNOTE: The vendor was contacted and it was learned that the product is not supported."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-66",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-66 SQL Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-02T08:22:47.232Z",
        "orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
        "shortName": "TR-CERT"
      },
      "references": [
        {
          "tags": [
            "government-resource",
            "broken-link"
          ],
          "url": "https://www.usom.gov.tr/bildirim/tr-24-1881"
        },
        {
          "tags": [
            "government-resource"
          ],
          "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-24-1881"
        }
      ],
      "source": {
        "advisory": "TR-24-1881",
        "defect": [
          "TR-24-1881"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "Unauthenticated SQLi in Eryaz IT\u0027s NatraCar B2B Dealer Management Program",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
    "assignerShortName": "TR-CERT",
    "cveId": "CVE-2024-8259",
    "datePublished": "2024-12-09T13:23:06.505Z",
    "dateReserved": "2024-08-28T09:08:16.109Z",
    "dateUpdated": "2026-06-02T08:22:47.232Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2024-8259 (GCVE-0-2024-8259)

    Vulnerability from cvelistv5 – Published: 2024-12-09 13:23 – Updated: 2026-06-02 08:22
    VLAI
    Title
    Unauthenticated SQLi in Eryaz IT's NatraCar B2B Dealer Management Program
    Summary
    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eryaz Information Technologies NatraCar B2B Dealer Management Program allows SQL Injection. This issue affects NatraCar B2B Dealer Management Program: through 09.12.2024. NOTE: The vendor was contacted and it was learned that the product is not supported.
    Severity
    9.8 (Critical)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    SSVC
    Exploitation: none Automatable: yes Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2024-12-09 15:13 UTC
    CWE
    • CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
    Assigner
    References
    Impacted products
    Vendor Product Version
    Eryaz Information Technologies NatraCar B2B Dealer Management Program Affected: 0 , ≤ 09.12.2024 (custom)
    		Create a notification for this product.
    eryaz_information_technologies natracar_b2b_dealer_management_program Affected: 0 , ≤ 09.12.2024 (custom)
        cpe:2.3:a:eryaz_information_technologies:natracar_b2b_dealer_management_program:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    Credits
    Pinar TASGIN
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:eryaz_information_technologies:natracar_b2b_dealer_management_program:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "natracar_b2b_dealer_management_program",
            "vendor": "eryaz_information_technologies",
            "versions": [
              {
                "lessThanOrEqual": "09.12.2024",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-8259",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-09T15:13:10.829916Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-03T19:26:35.191Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "NatraCar B2B Dealer Management Program",
          "vendor": "Eryaz Information Technologies",
          "versions": [
            {
              "lessThanOrEqual": "09.12.2024",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Pinar TASGIN"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027) vulnerability in Eryaz Information Technologies NatraCar B2B Dealer Management Program allows SQL Injection.\u003cp\u003eThis issue affects NatraCar B2B Dealer Management Program: through 09.12.2024.\u003cbr\u003e\u003c/p\u003e\u003cp\u003e\nNOTE: The vendor was contacted and it was learned that the product is not supported.\n\n\u003cbr\u003e\u003c/p\u003e"
            }
          ],
          "value": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027) vulnerability in Eryaz Information Technologies NatraCar B2B Dealer Management Program allows SQL Injection.\n\nThis issue affects NatraCar B2B Dealer Management Program: through 09.12.2024.\n\n\n\n\n\nNOTE: The vendor was contacted and it was learned that the product is not supported."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-66",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-66 SQL Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-02T08:22:47.232Z",
        "orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
        "shortName": "TR-CERT"
      },
      "references": [
        {
          "tags": [
            "government-resource",
            "broken-link"
          ],
          "url": "https://www.usom.gov.tr/bildirim/tr-24-1881"
        },
        {
          "tags": [
            "government-resource"
          ],
          "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-24-1881"
        }
      ],
      "source": {
        "advisory": "TR-24-1881",
        "defect": [
          "TR-24-1881"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "Unauthenticated SQLi in Eryaz IT\u0027s NatraCar B2B Dealer Management Program",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
    "assignerShortName": "TR-CERT",
    "cveId": "CVE-2024-8259",
    "datePublished": "2024-12-09T13:23:06.505Z",
    "dateReserved": "2024-08-28T09:08:16.109Z",
    "dateUpdated": "2026-06-02T08:22:47.232Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}