Vulnerabilities > CVE-2024-24572 - Unspecified vulnerability in Facilemanager

CVSS 6.5 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

HIGH

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

NONE

network

low complexity

facilemanager

NVD

Published: 2024-01-31

Updated: 2024-11-21

Summary

facileManager is a modular suite of web apps built with the sysadmin in mind. In versions 4.5.0 and earlier, the $_REQUEST global array was unsafely called inside an extract() function in admin-logs.php. The PHP file fm-init.php prevents arbitrary manipulation of $_SESSION via the GET/POST parameters. However, it does not prevent manipulation of any other sensitive variables such as $search_sql. Knowing this, an authenticated user with privileges to view site logs can manipulate the search_sql variable by appending a GET parameter search_sql in the URL. The information above means that the checks and SQL injection prevention attempts were rendered unusable.

Vulnerable Configurations

Part	Description	Count
Application	Facilemanager Facilemanager Facilemanager 1.0 Facilemanager Facilemanager 1.0.1 Facilemanager Facilemanager 1.0.2 Facilemanager Facilemanager 1.1 Facilemanager Facilemanager 1.1.1 Facilemanager Facilemanager 1.1.2 Facilemanager Facilemanager 1.2 Facilemanager Facilemanager 1.2.1 Facilemanager Facilemanager 1.2.2 Facilemanager Facilemanager 1.2.3 Facilemanager Facilemanager 1.3 Facilemanager Facilemanager 1.3.1 Facilemanager Facilemanager 2.0 Facilemanager Facilemanager 2.0.1 Facilemanager Facilemanager 2.0.2 Facilemanager Facilemanager 2.0.3 Facilemanager Facilemanager 2.1 Facilemanager Facilemanager 2.1.1 Facilemanager Facilemanager 2.1.2 Facilemanager Facilemanager 2.1.3 Facilemanager Facilemanager 2.1.4 Facilemanager Facilemanager 2.1.5 Facilemanager Facilemanager 2.2 Facilemanager Facilemanager 2.2.1 Facilemanager Facilemanager 2.3 Facilemanager Facilemanager 2.3.1 Facilemanager Facilemanager 2.3.2 Facilemanager Facilemanager 2.3.3 Facilemanager Facilemanager 3.0 Facilemanager Facilemanager 3.0.1 Facilemanager Facilemanager 3.0.2 Facilemanager Facilemanager 3.0.3 Facilemanager Facilemanager 3.1.0 Facilemanager Facilemanager 3.1.1 Facilemanager Facilemanager 3.2 Facilemanager Facilemanager 3.3 Facilemanager Facilemanager 3.4 Facilemanager Facilemanager 3.4.1 Facilemanager Facilemanager 3.4.2 Facilemanager Facilemanager 3.5.0 Facilemanager Facilemanager 3.5.1 Facilemanager Facilemanager 3.5.2 Facilemanager Facilemanager 3.5.3 Facilemanager Facilemanager 3.5.4 Facilemanager Facilemanager 3.5.5 Facilemanager Facilemanager 3.5.6 Facilemanager Facilemanager 3.5.7 Facilemanager Facilemanager 4.0.0 Facilemanager Facilemanager 4.0.1 Facilemanager Facilemanager 4.0.2 Facilemanager Facilemanager 4.0.3 Facilemanager Facilemanager 4.1.0 Facilemanager Facilemanager 4.1.1 Facilemanager Facilemanager 4.1.2 Facilemanager Facilemanager 4.2.0 Facilemanager Facilemanager 4.3.0 Facilemanager Facilemanager 4.4.0 Facilemanager Facilemanager 4.5.0	58

Summary

Vulnerable Configurations

References