Chamilo - SQLi (CVE-2024-7029)
Description
Commands can be injected over the network and executed without authentication.
psychologyCrowdSec Analysis
CVE-2024-7029 is a vulnerability that allows unauthenticated remote command injection through a web-accessible CGI endpoint, leading to potential compromise of affected systems.
CrowdSec has been tracking this vulnerability and its exploits since 9th of October 2024.
CrowdSec network data shows that most actors exploiting CVE-2024-7029 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature. CrowdSec data also reveals a clear uptick in attacks involving CVE-2024-7029 over the past week. Activity is above the usual baseline, suggesting growing attention from attackers. This may reflect rising awareness, recent exploit releases, or expanded targeting efforts.
Attackers are directing their attempts at URLs containing /cgi-bin/supervisor/factory.cgi.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2024-08-02 |
| Rule Released | 2024-10-09 |
| CrowdSec First Seen | 2024-11-23 |
Related Weaknesses
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.