« Volver al listado

CVE-2024-33485

Estado: AplazadaCrítica (9.8)—

SQL Injection vulnerability in CASAP Automated Enrollment System using PHP/MySQLi with Source Code V1.0 allows a remote attacker to obtain sensitive information via a crafted payload to the login.php component

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (3)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Casap — Automated Enrollment SystemAIMysql — MysqliAIPHP — PHPAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-33485",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-33485",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-05-15T14:32:36.507008Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:casap_automated_enrollment_system_project:casap_automated_enrollment_system:1.0:*:*:*:*:*:*:*"
          ],
          "vendor": "casap_automated_enrollment_system_project",
          "product": "casap_automated_enrollment_system",
          "versions": [
            {
              "status": "affected",
              "version": "1.0"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-05-14T18:15:11.950",
  "references": [
    {
      "url": "https://github.com/CveSecLook/cve/issues/17",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.exploit-db.com/exploits/49463",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/CveSecLook/cve/issues/17",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "SQL Injection vulnerability in CASAP Automated Enrollment System using PHP/MySQLi with Source Code V1.0 allows a remote attacker to obtain sensitive information via a crafted payload to the login.php component"
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de inyección SQL en el sistema de inscripción automatizada CASAP usando PHP/MySQLi con Source Code V1.0 permite a un atacante remoto obtener información confidencial a través de un payload manipulado para el componente login.php"
    }
  ],
  "lastModified": "2026-06-17T07:31:50.600",
  "sourceIdentifier": "cve@mitre.org"
}