Description
NovaCHRON Zeitsysteme GmbH & Co. KG 的 Smart Time Plus v8.x 至 v8.6 版本被发现存在一个 SQL注入漏洞。该漏洞通过 smarttimeplus/MySQLConnection 端点的 getCookieNames 方法触发，攻击者可以利用该漏洞执行任意SQL 查询，可能导致敏感数据泄露或数据库被完全控制。
Smart Time Plus /smarttimeplus/MySQLConnection SQL注入漏洞（CVE-2024-53544）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2024-53544
https://secure77.de/smart-time-plus-rce-cve-2024-53543/
https://www.tenable.com/cve/CVE-2024-53544
https://vuldb.com/vuln/296715
https://cve.imfht.com/detail/CVE-2024-53544
https://blog.csdn.net/qq_43540348/article/details/146222414
https://www.cve.org/CVERecord?id=CVE-2024-53544