CVE-2024-45265

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A SQL injection vulnerability in the poll component in SkySystem Arfa-CMS before 5.1.3124 allows remote attackers to execute arbitrary SQL commands via the psid parameter.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89 CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a
skysystem	arfa_cms	< 5.1.3124

References

https://github.com/TheHermione/CVE-2024-45265Third Party Advisory
https://skyss.ruProduct

Timeline

Published: Aug 26, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-452694.3WordPress plugin "Carousel Slider" provided by Sayful Islam contains a cross-site request forgery vulnerability on Carousel image selection CVE-2024-45276.1A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0. It has been classified as problematic. Affected is a CVE-2024-452704.3WordPress plugin "Carousel Slider" provided by Sayful Islam contains a cross-site request forgery vulnerability on Hero image selection feat CVE-2024-452717.8An unauthenticated local attacker can gain admin privileges by deploying a config file due to improper input validation.CVE-2024-452727.5An unauthenticated remote attacker can perform a brute-force attack on the credentials of the remote service portal with a high chance of su CVE-2024-452737.8An unauthenticated local attacker can decrypt the devices config file and therefore compromise the device due to a weak implementation of th CVE-2024-452749.8An unauthenticated remote attacker can execute OS commands via UDP on the device due to missing authentication.CVE-2024-452759.8The devices contain two hard coded user accounts with hardcoded passwords that allow an unauthenticated remote attacker for full control of CVE-2024-452767.5An unauthenticated remote attacker can get read access to files in the "/tmp" directory due to missing authentication.CVE-2024-452774.3The SAP HANA Node.js client package versions from 2.0.0 before 2.21.31 is impacted by Prototype Pollution vulnerability allowing an attacker CVE-2024-452785.4SAP Commerce Backoffice does not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. After su CVE-2024-452796.1Due to insufficient input validation, CRM Blueprint Application Builder Panel of SAP NetWeaver Application Server for ABAP allows an unauthe