CVE-2024-9294

CVE-2024-9294 is a critical SQL injection vulnerability found in the dingfanzu CMS, specifically within the saveNewPwd.php file when processing the 'username' argument. This flaw allows for remote exploitation, potentially leading to unauthorized access or data manipulation. While the CVSS score is Medium (6.3), indicating a lower impact, the public disclosure of an exploit and the continuous delivery model of the product necessitate immediate attention. There is currently no evidence of active exploitation, nor are there readily available exploits in common frameworks like Metasploit or Nuclei, and community discussion remains minimal.