CVE-2024-44903

Description

SQL Injection can occur in the SirsiDynix Horizon Information Portal (IPAC20) through 3.25_9382; however, a patch is available from the vendor. This is in ipac.jsp in a SELECT WHERE statement, in a part of the uri= variable in the second part of the full= inner variable.

Reserved 2024-08-21 | Published 2025-03-25 | Updated 2025-03-25 | Assigner mitre

Problem types

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Product status

Default status
unknown

Any version
affected

References

www.artresilia.com/...ability-in-horizon-information-portal/

cve.org (CVE-2024-44903)

nvd.nist.gov (CVE-2024-44903)

Download JSON