CVE-2024-24572

    Dashboard / Vulnerabilities / CVE-2024-24572

    CVE-2024-24572

    Published: 31 Jan 2024Last Modified: 28 Oct 2026

    Summary: facileManager Authenticated Variable Manipulation leading to SQL Injection

    Details: facileManager is a modular suite of web apps built with the sysadmin in mind. In versions 4.5.0 and earlier, the $_REQUEST global array was unsafely called inside an extract() function in admin-logs.php. The PHP file fm-init.php prevents arbitrary manipulation of $_SESSION via the GET/POST parameters. However, it does not prevent manipulation of any other sensitive variables such as $search_sql. Knowing this, an authenticated user with privileges to view site logs can manipulate the search_sql variable by appending a GET parameter search_sql in the URL. The information above means that the checks and SQL injection prevention attempts were rendered unusable.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/24xxx/CVE-2024-24572.json, https://github.com/WillyXJ/facileManager/security/advisories/GHSA-xw34-8pj6-75gc, https://nvd.nist.gov/vuln/detail/CVE-2024-24572, https://github.com/WillyXJ/facileManager/commit/0aa850d4b518f10143a4c675142b15caa5872877

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -0aa850d4b518f10143a4c675142b15caa5872877

    Affected versions

    v4.5.0-complete

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2024-24572 | CVE-DB