CVE-2024-4893
📛 CVE Title
DigiWin EasyFlow .NET - SQL Injection
Description
DigiWin EasyFlow .NET lacks validation for certain input parameters, allowing remote attackers to inject arbitrary SQL commands. This vulnerability enables unauthorized access to read, modify, and delete database records, as well as execute system commands.
Overview
- State
- PUBLISHED
- Assigner (CNA)
- twcert
- CVSS severity
- CRITICAL
- CVSS score
- 9.8 / 10
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- Effective score
- 9.8 / 10 CRITICAL source: CNA overview
- CWE(s)
-
CWE-89 - Reserved
- 2024-05-15
- Published
- 2024-05-15 04:31 UTC
- Last updated
- 2024-08-01 22:55 UTC
- Source
- https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/4xxx/CVE-2024-4893.json
- Linked Threat
- CVE-2024-4893 — DigiWin EasyFlow .NET - SQL Injection
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2024-44461 - Assigner
- twcert
- Published
- May 15, 2024, 2:31:29 AM
- Updated
- Aug 1, 2024, 8:55:10 PM
- EUVD base score (CVSS 3.1)
-
9.8 / 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EUVD-reported EPSS
- 0.5900
- Vendors
- DigiWin
- Products
-
EasyFlow .NET (6.1.x)EasyFlow .NET (6.6.x <v6.6.15)EasyFlow .NET (5.x)EasyFlow .NET (3.x)
- Aliases
-
GHSA-mf7p-qx2j-rmq3
ENISA description: DigiWin EasyFlow .NET lacks validation for certain input parameters, allowing remote attackers to inject arbitrary SQL commands. This vulnerability enables unauthorized access to read, modify, and delete database records, as well as execute system commands.
Affected products (1)
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| DigiWin | EasyFlow .NET |
3.x (affected),
5.x (affected),
6.1.x (affected),
6.6.x (affected)
|
— |
Vendor references (2)
References embedded in the original CVE record by the assigning CNA.
- https://www.twcert.org.tw/tw/cp-132-7800-843f1-1.html third-party-advisory
- https://www.twcert.org.tw/en/cp-139-7801-67d07-2.html third-party-advisory
Web references (0)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
No web references attached yet.
Remediations (16)
Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.
-
web:www.nist.gov
NIST maintains the National Vulnerability Database (NVD), a repository of information on software and hardware flaws that can compromise computer security. This is a key piece of the nation's cybersecurity infrastructure.
2026-08-05 14:27 UTC -
web:success.trendmicro.com
Release Date: October 15, 2024 CVE Identifiers: CVE - 2024 -48903 Platform: Windows CVSS 3.0 Score (s): 7.8 Severity Rating (s): High Trend Micro has released a new update for Trend Micro Deep Security 20.0 Agent that resolves an improper access control local privilege vulnerability.
2026-08-05 14:27 UTC -
web:www.oracle.com
Prior Critical Patch Update and Critical Security Patch Update advisories should be reviewed for information regarding earlier published security patches. Refer to Critical Patch Updates, Critical Security Patch Updates, Security Alerts and Bulletins for information about Oracle Security advisories.
2026-08-05 14:27 UTC -
web:www.microsoft.com
Microsoft's free Security Update Guide Notifications provide links to security-related software updates and notification of re-released security updates. These notifications are sent via email throughout the month as needed. You can choose the type of updates for which you want to be notified: Major ...
2026-08-05 14:27 UTC -
web:www.veeam.com
When a vulnerability is identified, our team promptly develops a patch to address and mitigate the risk. In line with our dedication to transparency, we publicly disclose the vulnerability and provide detailed mitigation information.
2026-08-05 14:27 UTC -
web:www.veeam.com
When a vulnerability is identified, our team promptly develops a patch to address and mitigate the risk. In line with our dedication to transparency, we publicly disclose the vulnerability and provide detailed mitigation information.
2026-08-05 14:27 UTC -
web:www.computerworld.com
Each month, the team at Readiness analyzes the latest Patch Tuesday updates from Microsoft and provides detailed, actionable testing guidance. The company's Patch Tuesday release for February ...
2026-05-22 10:39 UTC -
web:cyberpress.org
A newly published proof-of-concept tool called BitUnlocker exposes a dangerous downgrade attack that can bypass Microsoft's BitLocker full-disk encryption on fully patched Windows 11 machines, granting complete access to encrypted drives in under five minutes. The attack exploits CVE -2025-48804, a vulnerability in Windows BitLocker that allows an attacker to mix untrusted data with trusted ...
2026-05-22 10:39 UTC -
web:www.oracle.com
This Critical Patch Update contains 481 new security patches across the product families listed below. Please note that an MOS note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at April 2026 Critical Patch Update: Executive Summary and Analysis.
2026-05-22 10:39 UTC -
web:www.securityweek.com
Microsoft has announced mitigations for CVE -2026-45585, a BitLocker bypass triggered via FsTx in Windows Recovery.
2026-05-22 10:39 UTC -
web:www.cve.org
At cve .org, we provide the authoritative reference method for publicly known information-security vulnerabilities and exposures
2026-05-22 10:39 UTC -
web:cybersecuritynews.com
No patch has been released yet; Microsoft has instead issued a multi-step manual mitigation guide while a formal security update is prepared. Windows BitLocker Security Bypass The vulnerability originates in WinRE's handling of the BootExecute registry value under HKLM\ControlSet001\Control\Session Manager.
2026-05-22 10:39 UTC -
web:nvd.nist.gov
Secure .gov websites use HTTPS A lock () or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.
2026-05-22 10:39 UTC -
web:portal.msrc.microsoft.com
The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.
2026-05-22 10:39 UTC -
web:robertsspaceindustries.com
Hi Everyone! Time again for another Hotfix Central thread to keep you all up to date on things going on outside of the normal patch cycle in SC Alpha 4.8 LIVE! This will be a living document of...
2026-05-22 10:39 UTC -
web:www.cisa.gov
If vulnerabilities cannot be remediated within the recommended timeframes, develop a remediation plan for action and coordination across the organization. The remediation plan should include: Vulnerability remediation constraints Interim mitigation actions to overcome constraints Final actions required to remediate vulnerability
2026-05-22 10:39 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.
Raw JSON
The full cvelistV5 record. Download as CVE-2024-4893.json.
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:digiwin:easyflow_.net:6.6.x:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "easyflow_.net",
"vendor": "digiwin",
"versions": [
{
"status": "affected",
"version": "6.6.x"
}
]
},
{
"cpes": [
"cpe:2.3:a:digiwin:easyflow_.net:3.x:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "easyflow_.net",
"vendor": "digiwin",
"versions": [
{
"status": "affected",
"version": "3.x"
}
]
},
{
"cpes": [
"cpe:2.3:a:digiwin:easyflow_.net:5.x:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "easyflow_.net",
"vendor": "digiwin",
"versions": [
{
"status": "affected",
"version": "5.x"
}
]
},
{
"cpes": [
"cpe:2.3:a:digiwin:easyflow_.net:6.1.x:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "easyflow_.net",
"vendor": "digiwin",
"versions": [
{
"status": "affected",
"version": "6.1.x"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-4893",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-15T14:28:12.553304Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:56:01.777Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T20:55:10.269Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"third-party-advisory",
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-7800-843f1-1.html"
},
{
"tags": [
"third-party-advisory",
"x_transferred"
],
"url": "https://www.twcert.org.tw/en/cp-139-7801-67d07-2.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "EasyFlow .NET",
"vendor": "DigiWin",
"versions": [
{
"status": "affected",
"version": "3.x"
},
{
"status": "affected",
"version": "5.x"
},
{
"status": "affected",
"version": "6.1.x"
},
{
"lessThan": "v6.6.15",
"status": "affected",
"version": "6.6.x",
"versionType": "custom"
}
]
}
],
"datePublic": "2024-05-15T02:17:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "DigiWin EasyFlow .NET lacks validation for certain input parameters, allowing remote attackers to inject arbitrary SQL commands. This vulnerability enables unauthorized access to read, modify, and delete database records, as well as execute system commands."
}
],
"value": "DigiWin EasyFlow .NET lacks validation for certain input parameters, allowing remote attackers to inject arbitrary SQL commands. This vulnerability enables unauthorized access to read, modify, and delete database records, as well as execute system commands."
}
],
"impacts": [
{
"capecId": "CAPEC-66",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-66 SQL Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-03T09:48:43.162Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://www.twcert.org.tw/tw/cp-132-7800-843f1-1.html"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.twcert.org.tw/en/cp-139-7801-67d07-2.html"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Install patch for V3.x, V5.x and V6.1.x (released on 2023/12/30 or later).<br>Update V6.6.x to V6.6.15 or later version."
}
],
"value": "Install patch for V3.x, V5.x and V6.1.x (released on 2023/12/30 or later).\nUpdate V6.6.x to V6.6.15 or later version."
}
],
"source": {
"advisory": "TVN-202405001",
"discovery": "EXTERNAL"
},
"title": "DigiWin EasyFlow .NET - SQL Injection",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2024-4893",
"datePublished": "2024-05-15T02:31:29.475Z",
"dateReserved": "2024-05-15T02:08:20.026Z",
"dateUpdated": "2024-08-01T20:55:10.269Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}