Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Sunnet eHDR CTMS Allows Unauthorized Database Access

CVE-2024-10440 · published 2 years ago
Summary

The Sunnet eHDR CTMS software has a security weakness that lets hackers access sensitive data without permission. This means they can potentially read, change, or delete important information stored in the database. You should update the software to the latest version to fix this issue.

What to do
  • Update sun.net ehrd_ctms to version 10.0 or later.
Affected software
VendorProductAffected versions
sun.net ehrd_ctms < 10.0
cpe:2.3:a:sun.net:ehrd_ctms:*:*:*:*:*:*:*:*
Original advisory text
The eHDR CTMS from Sunnet has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL command to read, modify, and delete database contents.
The eHDR CTMS from Sunnet has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL command to read, modify, and delete database contents.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-89SQL Injection
Timeline
Published28 Oct 2024
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2024-10440 · NVD
Track software like this
Free during beta