Cloudlog - SQL Injection
Cloudlog 2.6.15 contains a SQL injection caused by unsanitized input in oqrs.php request_form, letting attackers execute arbitrary SQL commands via station_id or callsign, exploit requires sending crafted request. References: https://chiggerlor.substack.com/p/unauthenticated-sql-injection-in-9a3 https://github.com/magicbug/Cloudlog https://nvd.nist.gov/vuln/detail/CVE-2024-48259 Remediation: Update to the latest version of Cloudlog where this issue is fixed, or sanitize inputs properly.
Used 3.1k times · domain, subdomain, ipv4