CVE-2024-13979
CVSS v3
9.8
CRITICAL
EPSS Score
6.0 %
exploit probability
CISA KEV
No
known exploited
Exploitation
—
SSVC status
Description
A SQL injection vulnerability exists in the St. Joe ERP system ("圣乔ERP系统") that allows unauthenticated remote attackers to execute arbitrary SQL commands via crafted HTTP POST requests to the login endpoint. The application fails to properly sanitize user-supplied input before incorporating it into SQL queries, enabling direct manipulation of the backend database. Successful exploitation may result in unauthorized data access, modification of records, or limited disruption of service. An affected version range is undefined. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-04-14 UTC.
Technical details
- Published
- 2025-08-27
Frequently asked questions
What is CVE-2024-13979?
A SQL injection vulnerability exists in the St. Joe ERP system ("圣乔ERP系统") that allows unauthenticated remote attackers to execute arbitrary SQL commands via crafted HTTP POST requests to the login endpoint. The application fails to properly sanitize user-supplied input before incorporating it into SQL queries, enabling direct manipulation of the backend database. Successful exploitation may result in unauthorized data access, modification of records, or limited disruption of service. An affected version range is undefined. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-04-14 UTC.
Is CVE-2024-13979 actively exploited?
Active exploitation of CVE-2024-13979 has not been confirmed. The EPSS score is 6.0%, indicating the estimated probability of exploitation in the next 30 days.
What is the CVSS score for CVE-2024-13979?
CVE-2024-13979 has a CVSS v3 base score of 9.8 (CRITICAL severity).
Is CVE-2024-13979 affecting your environment?
Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.
No credit card required · 500 free checks/month · Free API key
Other 2024 vulnerabilities worth triaging
Ranked by exploit probability (EPSS).