PT-2024-38987

CVE-2024-8395

Published

2024-09-05

Updated

2025-11-25

Description by

CVSS 3.1

9.8

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: FlyCASS CASS and KCM systems (affected versions not specified)

Description: The issue is related to a flaw in SQL query filtering in FlyCASS CASS and KCM systems, making them vulnerable to attack by outside attackers with no authentication. This allows unauthenticated attackers to potentially inject SQL queries.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploitability

Exploit

Impacts

Researchers

Ian Carroll

Sam Curry

Vendors

Affected products

Weakness enumeration

CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')

Related identifiers