CVE-2024-29875: SQL Injection in Sentrifugo 3.2

This SQL injection vulnerability allows a remote attacker to inject arbitrary SQL code into the sort_name parameter of the /sentrifugo/index.php/default/reports/exportactiveuserrpt endpoint. Successful exploitation could enable the attacker to bypass security measures and directly query the underlying database. The attacker could extract sensitive data, including user credentials, configuration details, and potentially even system files, depending on the database permissions. This represents a significant data breach risk and could lead to further compromise of the system. The potential impact is substantial, as the attacker gains direct access to the database, bypassing standard application security layers.

1. Reserved2024-03-21
2. Published2024-03-21
3. Modified2024-08-02
4. EPSS updated2026-04-02

The primary mitigation for CVE-2024-29875 is to immediately upgrade Sentrifugo to version 3.2.1 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds such as input validation and sanitization on the sort_name parameter. Web application firewalls (WAFs) configured to detect and block SQL injection attempts can also provide a layer of defense. Monitor access logs for suspicious SQL queries targeting the /sentrifugo/index.php/default/reports/exportactiveuserrpt endpoint. After upgrading, confirm the vulnerability is resolved by attempting a test query with a known malicious payload and verifying that it is properly sanitized.