Platform
php
Component
wowwo-crm
Fixed in
1.0.1
CVE-2024-12150 describes a critical SQL Injection vulnerability affecting Wowwo CRM. This flaw allows attackers to perform Blind SQL Injection, potentially leading to unauthorized data access and manipulation within the CRM system. The vulnerability impacts versions 0–0 of Wowwo CRM. A fix is available in version 0.0.1, but vendor confirmation of the fix is pending.
The SQL Injection vulnerability in Wowwo CRM (CVE-2024-12150) poses a significant risk to data confidentiality and integrity. An attacker exploiting this flaw can bypass authentication mechanisms and directly query the database, potentially extracting sensitive customer data, financial records, and internal system configurations. The 'Blind SQL Injection' nature of the vulnerability means the attacker doesn't receive direct feedback from the database, requiring them to infer information through trial and error, but the potential impact remains severe. Successful exploitation could lead to complete compromise of the CRM system and associated data.
CVE-2024-12150 is currently not listed on the CISA KEV catalog. The EPSS score is likely to be medium or high given the CRITICAL CVSS score and the potential for Blind SQL Injection. Public proof-of-concept exploits are not currently known, but the vulnerability's nature makes it a likely target for exploitation. The vulnerability was published on 2025-06-27.
Exploit Status
EPSS
0.06% (19% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2024-12150 is to immediately upgrade Wowwo CRM to version 0.0.1. If upgrading is not immediately feasible due to compatibility issues or downtime concerns, consider implementing a Web Application Firewall (WAF) with rules designed to detect and block SQL Injection attempts targeting the vulnerable endpoints. Carefully review and sanitize all user inputs to prevent malicious SQL code from being injected into database queries. Monitor database logs for suspicious activity, such as unusual query patterns or error messages related to SQL syntax. The vendor has not confirmed the fix, so thorough testing is essential after upgrading.
Update Wowwo CRM to the latest version available from the vendor, once a patched version is released. Refer to the vendor's website for updates and specific instructions on how to apply the patch or update.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2024-12150 is a critical SQL Injection vulnerability in Wowwo CRM allowing Blind SQL Injection, potentially leading to unauthorized data access. It impacts versions 0–0.
If you are using Wowwo CRM version 0–0, you are potentially affected by this vulnerability. Upgrade to version 0.0.1 as soon as possible.
The recommended fix is to upgrade to version 0.0.1 of Wowwo CRM. If upgrading is not immediately possible, implement WAF rules and sanitize user inputs.
While no active exploitation has been confirmed, the vulnerability's nature makes it a likely target. Monitor your systems closely for suspicious activity.
Please refer to the vendor's official website or security advisory channels for the latest information regarding CVE-2024-12150.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.