CVE-2024-10597

CVE-2024-10597 is a critical SQL injection vulnerability affecting ESAFENET CDG 5, specifically within the delPolicyAction function of the PolicyActionService.java file. This flaw allows an unauthenticated attacker to remotely execute arbitrary SQL commands by manipulating the 'id' argument, leading to complete compromise of confidentiality, integrity, and availability. With a CVSS score of 9.8 (Critical), the vulnerability is easily exploitable over the network with low attack complexity and no user interaction. While public exploit details exist, there is no evidence of active exploitation, Metasploit modules, or significant community discussion, despite the vendor's unresponsiveness to early disclosure.