Search
Find a vulnerability
Search criteria
2 vulnerabilities found for Smart S20 Management Platform by Byzoro
CVE-2024-1254 (GCVE-0-2024-1254)
Vulnerability from nvd – Published: 2024-02-06 18:31 – Updated: 2024-08-22 19:10
VLAI
Title
Byzoro Smart S20 Management Platform sysmanageajax.php sql injection
Summary
A vulnerability, which was classified as critical, was found in Byzoro Smart S20 Management Platform up to 20231120. This affects an unknown part of the file /sysmanage/sysmanageajax.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-252993 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Severity
4.7 (Medium)
4.7 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-89 - SQL Injection
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.252993 | vdb-entrytechnical-description |
| https://vuldb.com/?ctiid.252993 | signaturepermissions-required |
| https://vuldb.com/?submit.274042 | third-party-advisory |
| https://github.com/rockersiyuan/CVE/blob/main/Sma… | exploit |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Byzoro | Smart S20 Management Platform |
Affected:
20231120
|
|
| byzoro | smart_s20_management_platform |
Affected:
20231120
cpe:2.3:a:byzoro:smart_s20_management_platform:20231120:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-01T18:33:25.337Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "VDB-252993 | Byzoro Smart S20 Management Platform sysmanageajax.php sql injection",
"tags": [
"vdb-entry",
"technical-description",
"x_transferred"
],
"url": "https://vuldb.com/?id.252993"
},
{
"name": "VDB-252993 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required",
"x_transferred"
],
"url": "https://vuldb.com/?ctiid.252993"
},
{
"name": "Submit #274042 | Beijing Baizhuo Network Technology Co., Ltd. Smart S20 Smart S20 up to 20231120 SQL injection",
"tags": [
"third-party-advisory",
"x_transferred"
],
"url": "https://vuldb.com/?submit.274042"
},
{
"tags": [
"exploit",
"x_transferred"
],
"url": "https://github.com/rockersiyuan/CVE/blob/main/Smart%20S20.md"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:byzoro:smart_s20_management_platform:20231120:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "smart_s20_management_platform",
"vendor": "byzoro",
"versions": [
{
"status": "affected",
"version": "20231120"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-1254",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-02-07T15:39:05.934478Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-22T19:10:58.085Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Smart S20 Management Platform",
"vendor": "Byzoro",
"versions": [
{
"status": "affected",
"version": "20231120"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "rocker (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability, which was classified as critical, was found in Byzoro Smart S20 Management Platform up to 20231120. This affects an unknown part of the file /sysmanage/sysmanageajax.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-252993 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way."
},
{
"lang": "de",
"value": "Es wurde eine kritische Schwachstelle in Byzoro Smart S20 Management Platform bis 20231120 gefunden. Dabei betrifft es einen unbekannter Codeteil der Datei /sysmanage/sysmanageajax.php. Durch Manipulation des Arguments id mit unbekannten Daten kann eine sql injection-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs kann dabei \u00fcber das Netzwerk erfolgen. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5.8,
"vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 SQL Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-04-09T08:34:42.607Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-252993 | Byzoro Smart S20 Management Platform sysmanageajax.php sql injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.252993"
},
{
"name": "VDB-252993 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.252993"
},
{
"name": "Submit #274042 | Beijing Baizhuo Network Technology Co., Ltd. Smart S20 Smart S20 up to 20231120 SQL injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.274042"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/rockersiyuan/CVE/blob/main/Smart%20S20.md"
}
],
"timeline": [
{
"lang": "en",
"time": "2024-02-06T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2024-02-06T00:00:00.000Z",
"value": "CVE reserved"
},
{
"lang": "en",
"time": "2024-02-06T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2024-04-09T09:07:21.000Z",
"value": "VulDB entry last update"
}
],
"title": "Byzoro Smart S20 Management Platform sysmanageajax.php sql injection"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2024-1254",
"datePublished": "2024-02-06T18:31:04.295Z",
"dateReserved": "2024-02-06T08:13:21.878Z",
"dateUpdated": "2024-08-22T19:10:58.085Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-1254 (GCVE-0-2024-1254)
Vulnerability from cvelistv5 – Published: 2024-02-06 18:31 – Updated: 2024-08-22 19:10
VLAI
Title
Byzoro Smart S20 Management Platform sysmanageajax.php sql injection
Summary
A vulnerability, which was classified as critical, was found in Byzoro Smart S20 Management Platform up to 20231120. This affects an unknown part of the file /sysmanage/sysmanageajax.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-252993 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Severity
4.7 (Medium)
4.7 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-89 - SQL Injection
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.252993 | vdb-entrytechnical-description |
| https://vuldb.com/?ctiid.252993 | signaturepermissions-required |
| https://vuldb.com/?submit.274042 | third-party-advisory |
| https://github.com/rockersiyuan/CVE/blob/main/Sma… | exploit |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Byzoro | Smart S20 Management Platform |
Affected:
20231120
|
|
| byzoro | smart_s20_management_platform |
Affected:
20231120
cpe:2.3:a:byzoro:smart_s20_management_platform:20231120:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-01T18:33:25.337Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "VDB-252993 | Byzoro Smart S20 Management Platform sysmanageajax.php sql injection",
"tags": [
"vdb-entry",
"technical-description",
"x_transferred"
],
"url": "https://vuldb.com/?id.252993"
},
{
"name": "VDB-252993 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required",
"x_transferred"
],
"url": "https://vuldb.com/?ctiid.252993"
},
{
"name": "Submit #274042 | Beijing Baizhuo Network Technology Co., Ltd. Smart S20 Smart S20 up to 20231120 SQL injection",
"tags": [
"third-party-advisory",
"x_transferred"
],
"url": "https://vuldb.com/?submit.274042"
},
{
"tags": [
"exploit",
"x_transferred"
],
"url": "https://github.com/rockersiyuan/CVE/blob/main/Smart%20S20.md"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:byzoro:smart_s20_management_platform:20231120:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "smart_s20_management_platform",
"vendor": "byzoro",
"versions": [
{
"status": "affected",
"version": "20231120"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-1254",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-02-07T15:39:05.934478Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-22T19:10:58.085Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Smart S20 Management Platform",
"vendor": "Byzoro",
"versions": [
{
"status": "affected",
"version": "20231120"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "rocker (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability, which was classified as critical, was found in Byzoro Smart S20 Management Platform up to 20231120. This affects an unknown part of the file /sysmanage/sysmanageajax.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-252993 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way."
},
{
"lang": "de",
"value": "Es wurde eine kritische Schwachstelle in Byzoro Smart S20 Management Platform bis 20231120 gefunden. Dabei betrifft es einen unbekannter Codeteil der Datei /sysmanage/sysmanageajax.php. Durch Manipulation des Arguments id mit unbekannten Daten kann eine sql injection-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs kann dabei \u00fcber das Netzwerk erfolgen. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5.8,
"vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 SQL Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-04-09T08:34:42.607Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-252993 | Byzoro Smart S20 Management Platform sysmanageajax.php sql injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.252993"
},
{
"name": "VDB-252993 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.252993"
},
{
"name": "Submit #274042 | Beijing Baizhuo Network Technology Co., Ltd. Smart S20 Smart S20 up to 20231120 SQL injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.274042"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/rockersiyuan/CVE/blob/main/Smart%20S20.md"
}
],
"timeline": [
{
"lang": "en",
"time": "2024-02-06T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2024-02-06T00:00:00.000Z",
"value": "CVE reserved"
},
{
"lang": "en",
"time": "2024-02-06T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2024-04-09T09:07:21.000Z",
"value": "VulDB entry last update"
}
],
"title": "Byzoro Smart S20 Management Platform sysmanageajax.php sql injection"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2024-1254",
"datePublished": "2024-02-06T18:31:04.295Z",
"dateReserved": "2024-02-06T08:13:21.878Z",
"dateUpdated": "2024-08-22T19:10:58.085Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}