External risk intelligence

Lost and Found Information System 1.0 SQL Injection Privilege Escalation

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2024-37858

The vulnerability exists in a web-based information system designed for user interaction. As a web application, it is commonly deployed as an internet-facing service or an externally reachable web portal, making the vulnerable endpoint typically accessible over the network.

SQL Injection

Oretnom23 Lost And Found Information System

1.0

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical SQL injection vulnerability has been identified in the Lost and Found Information System. This flaw could allow an unauthorized remote attacker to gain elevated privileges within the system by exploiting a common web application weakness.

Attackers can inject harmful code into the system.
Critical flaws can impact system integrity and access.
Verify system relevance and exposure promptly.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending a crafted request over the network to the Lost and Found Information System. The attacker can then escalate their privileges by manipulating the 'id' parameter in the `manage_category.php` script. This could potentially lead to unauthorized access and modification of sensitive data within the system.

No authentication or user interaction required.
Exploits 'id' parameter in `manage_category.php`.
Risk of privilege escalation and data compromise.

Live Threat

Current exploitation, exposure, and threat context

A remote attacker could exploit a SQL injection vulnerability in the Lost and Found Information System when interacting with the `manage_category.php` page via the `id` parameter. This could lead to unauthorized access and modification of system data.

System administrative data.
Via network access to the `manage_category.php` endpoint.
Attacker could escalate privileges.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Lost and Found Information System is likely managed by an application owner or a platform team responsible for its maintenance. The immediate priority is to locate all instances of this system within the environment, determine their exposure and criticality, and identify the specific teams accountable for their operation and security. This will inform a targeted remediation plan, potentially involving coordination with the vendor if direct patching is not feasible.

Application owners should address this vulnerability.
Verify system reachability and business impact.
Plan vendor engagement and remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Lost and Found Information System?

The Lost and Found Information System by oretnom23 is a web-based application designed to manage items reported as lost or found. It typically includes administrative features for organizers to categorize and track these items. Organizations use such software to maintain a central database of property, often hosting it on web servers to allow users or staff to submit and view reports via a browser.

What does SQL injection mean for CVE-2024-37858?

SQL injection (CWE-89) occurs when an application improperly handles user-provided data, allowing an attacker to insert malicious database commands. In this specific case, it allows an unauthorized user to manipulate system logic, which leads to improper privilege management (CWE-269). This essentially means someone can trick the software into granting them administrative rights they should not have.

How does an attacker trigger this vulnerability?

An attacker triggers this flaw by sending a specially crafted request to the 'id' parameter within the 'manage_category.php' script. Because the system fails to safely sanitize this input, the malicious query is executed directly by the database. Simply browsing the site or performing standard actions does not trigger the bug; the attacker must specifically target that endpoint with manipulated input.

Is my system at risk?

Halo Surface Signal indicates this system is typically deployed as a web portal or internet-facing service, which significantly increases the risk since the vulnerable endpoint is reachable over the network. If your instance is accessible to the public internet, it is more likely to be targeted. You should prioritize checking if this application is reachable outside your internal network.

What should I do to secure my environment?

Start by auditing your network to identify all running instances of this software. Once located, verify who manages the application and determine if it is exposed to the internet. Since this involves a critical vulnerability, restrict network access to the affected script immediately while you coordinate with the vendor or your development team to apply a fix or update the application.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.