CVE-2024-29726 — Multiple vulnerabilities in SportsNET

CVE-2024-29726

Multiple vulnerabilities in SportsNET PUBLISHED

Description (CNA)

SQL injection vulnerabilities in SportsNET affecting version 4.0.1. These vulnerabilities could allow an attacker to retrieve, update and delete all information in the database by sending a specially crafted SQL query: https://XXXXXXX.saludydesafio.com/app/ax/setAsRead/, parameter id.

Affected (CNA)

Vendor / product	Versions
SportsNET / SportsNET	affected 4.0.1

CWE

CWE-89

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-sportsnet

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.