/Vulnerability Library

Cloudlog - SQL Injection

CVE-2024-48259
Verified

Description

Cloudlog 2.6.15 contains a SQL injection caused by unsanitized input in oqrs.php request_form, letting attackers execute arbitrary SQL commands via station_id or callsign, exploit requires sending crafted request.

Severity

High

CVSS Score

7.3

Exploit Probability

1%

Affected Product

cloudlog

Published Date

May 11, 2026

Template Author

s4e-io

CVE-2024-48259.yaml
7.3Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVE ID:
cve-2024-48259
CWE ID:
cwe-89

References

https://chiggerlor.substack.com/p/unauthenticated-sql-injection-in-9a3https://github.com/magicbug/Cloudloghttps://nvd.nist.gov/vuln/detail/CVE-2024-48259

Remediation Steps

Update to the latest version of Cloudlog where this issue is fixed, or sanitize inputs properly.