CVE-2024-10440 CRITICAL

CVE-2024-10440: Sunnet eHRD CTMS - SQL Injection

Vendor Sunnet

Product eHRD CTMS

Weakness CWE-89 · SQLi

Published October 28, 2024

Last update October 28, 2024

View on NVD All CVEs

CVSS base score

9.8/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

The eHDR CTMS from Sunnet has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL command to read, modify, and delete database contents.

Key dates

02Disclosure timeline

October 28, 2024 CVE published

October 28, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-10440 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/89.html

Related vulnerabilities

04Related CVE

CVE-2024-20417 Cisco Identity Services Engine REST API Blind SQL Injection Vulnerabities CVE-2023-2217 SourceCodester Task Reminder System manage_reminder.php sql injection CVE-2025-4712 Campcodes Sales and Inventory System account_summary.php sql injection CVE-2024-7643 SourceCodester Leads Manager Tool Delete Leads delete-leads.php sql injection CVE-2024-7754 SourceCodester Clinics Patient Management System check_medicine_name.php sql injection