CVE-2024-45875

Name of the Vulnerable Software and Affected Versions baltic-it TOPqw Webportal versions 1.35.287.1 through 1.35.290

Description The create user function in the baltic-it TOPqw Webportal is vulnerable to SQL injection. This issue affects the /Apps/TOPqw/BenutzerManagement.aspx/SaveNewUser endpoint, where the username variable in the JSON object allows the manipulation of SQL queries.

Recommendations For versions 1.35.287.1 through 1.35.290, update to version 1.35.291 to resolve the issue. As a temporary workaround, consider restricting access to the /Apps/TOPqw/BenutzerManagement.aspx/SaveNewUser endpoint until the update is applied.