What is CVE-2024-48509?

CVE-2024-48509 is a critical-severity vulnerability in Lang-Learn-Guy Learning With Texts, classified under SQL Injection. CVSS score: 9.8/10. Published 2024-10-21.

How severe is CVE-2024-48509?

Critical severity. CVSS v3 base score is 9.8 out of 10.

SQL Injection in Lang-Learn-Guy Learning With Texts

CVE-2024-48509

Learning with Texts (LWT) 2.0.3 is vulnerable to SQL Injection. This occurs when the application fails to properly sanitize user inputs, allowing attackers to manipulate SQL queries by injecting malicious SQL statements into URL parameters. By exploiting this vulnerability, an attacker could gain unauthorized access to the database, retrieve sensitive information, modify or delete data, and execute arbitrary commands.

Vulnerability class: SQL Injection

EPSS: 0.005 (43.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Lang-learn-guy Learning_with_texts — versions 2.0.3
N/a — versions n/a

Weakness classification (CWE)

CWE-89 — SQL Injection

References

cve@mitre.org (Third Party Advisory)

Frequently asked questions

What is CVE-2024-48509?: CVE-2024-48509 is a critical-severity vulnerability in Lang-Learn-Guy Learning With Texts, classified under SQL Injection. CVSS score: 9.8/10. Published 2024-10-21.
How severe is CVE-2024-48509?: Critical severity. CVSS v3 base score is 9.8 out of 10.