CVE-2024-8749

CVE-2024-8749 is a high-severity SQL injection vulnerability affecting i-doit pro version 28. An unauthenticated attacker can exploit this flaw by sending a specially crafted query to the ID parameter in the /var/www/html/src/classes/modules/api/model/cmdb/isys_api_model_cmdb_objects_by_relation.class.php endpoint. Successful exploitation allows for the full exfiltration of data stored in the database. The vulnerability has a CVSSv3 score of 7.5 (HIGH), indicating a network-based attack with low complexity and high impact on confidentiality, without requiring user interaction or privileges. While the EPSS score is low, suggesting a low probability of exploitation in the wild, its FAUCET Risk Score is 47/100. Currently, there is no known active exploitation, publicly available exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE. Organizations using i-doit pro version 28 should prioritize patching to mitigate this risk.