CVE-2024-12143
📛 CVE Title
SQLi in Mobilteg Mobile Informatics' Mikro Hand Terminal - MikroDB
Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mobilteg Mobile Informatics Mikro Hand Terminal - MikroDB allows SQL Injection.This issue affects Mikro Hand Terminal - MikroDB. NOTE: The vendor did not inform about the completion of the fixing process within the specified time. The CVE will be updated when new information becomes available.
Description (MITRE) cveawg.mitre.org
Pulled from cveawg.mitre.org/api/cve/CVE-2024-12143 on 2026-06-30. Shown when MITRE's text differs from the cvelistV5 mirror.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mobilteg Mobile Informatics Mikro Hand Terminal - MikroDB allows SQL Injection. This issue affects Mikro Hand Terminal - MikroDB. NOTE: The vendor did not inform about the completion of the fixing process within the specified time. The CVE will be updated when new information becomes available.
Overview
- State
- PUBLISHED
- Assigner (CNA)
- TR-CERT
- CVSS severity
- CRITICAL
- CVSS score
- 9.8 / 10
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- Effective score
- 9.8 / 10 CRITICAL source: CNA overview
- CWE(s)
-
CWE-89 - Reserved
- 2024-12-04
- Published
- 2025-06-27 19:00 UTC
- Last updated
- 2025-09-23 09:38 UTC
- Source
- https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/12xxx/CVE-2024-12143.json
- Linked Threat
- CVE-2024-12143 — SQLi in Mobilteg Mobile Informatics' Mikro Hand Terminal - MikroDB
NVD triage scoring NVD CVE 2.0
Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.
- NVD published
- 2025-06-27 17:15:32 UTC
- NVD last modified
- 2026-06-17 06:59:07 UTC
- NVD CVSS v3.1
- 9.8 / 10 CRITICAL source: iletisim@usom.gov.tr
- NVD CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- Exploitability subscore
- 3.9 / 10
- Impact subscore
- 5.9 / 10
- EPSS score
- 0.0035 (probability of exploitation in next 30 days)
- EPSS percentile
- 27.02% vs all CVEs — higher = more likely to be exploited, as of 2026-06-30
NVD / KEV / EPSS data refreshed 2026-06-30 15:11 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2024-54712 - Assigner
- TR-CERT
- Published
- Jun 27, 2025, 5:00:28 PM
- Updated
- Sep 23, 2025, 7:38:24 AM
- EUVD base score (CVSS 3.1)
-
9.8 / 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EUVD-reported EPSS
- 0.2400
- Vendors
- Mobilteg Mobile Informatics
- Products
-
Mikro Hand Terminal - MikroDB (0)
- Aliases
-
GHSA-q3cr-crgf-v8f7
ENISA description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mobilteg Mobile Informatics Mikro Hand Terminal - MikroDB allows SQL Injection.This issue affects Mikro Hand Terminal - MikroDB. NOTE: The vendor did not inform about the completion of the fixing process within the specified time. The CVE will be updated when new information becomes available.
EUVD references (1)
Affected products (1)
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| Mobilteg Mobile Informatics | Mikro Hand Terminal - MikroDB |
0 (affected)
|
— |
Vendor references (1)
References embedded in the original CVE record by the assigning CNA.
MITRE references (2) cveawg.mitre.org
Pulled from MITRE's CVE Services API by the 🛰 Backfill from MITRE button.
- https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0142 government-resource
- https://www.usom.gov.tr/bildirim/tr-25-0142 government-resource, broken-link
Web references (0)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
No web references attached yet.
NVD-tagged references (2)
Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.
- https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0142 iletisim@usom.gov.tr
- https://www.usom.gov.tr/bildirim/tr-25-0142 iletisim@usom.gov.tr
Indicators (1)
IOCs linked to the auto-promoted Threat row.
| Type | Value | VirusTotal | Attached |
|---|---|---|---|
| domain |
injection.this
|
no local data | 2026-05-18 21:19 UTC |
Remediations (18)
Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.
-
web:learn.microsoft.com
Remediate security weaknesses discovered through security recommendations, and create exceptions if needed, in Defender Vulnerability Management.
2026-07-07 13:55 UTC -
web:msrc.microsoft.com
The Microsoft Security Response Center (MSRC) investigates all reports of security vulnerabilities affecting Microsoft products and services, and provides the information here as part of the ongoing effort to help you manage security risks and help keep your systems protected.
2026-07-07 13:55 UTC -
web:www.ninjaone.com
Overview KB5094123 is a cumulative security update released on June 9, 2026, for Windows Server 2019 and Windows 10 Enterprise LTSC 2019 (OS Build 17763.8880). This patch addresses security vulnerabilities and quality improvements, with particular focus on Secure Boot certificate updates ahead of their expiration in June 2026. The update includes enhancements to system security and application ...
2026-07-07 13:55 UTC -
web:www.pcworld.com
A Windows 11 update reveals a bug that can silently consume up to 500GB of storage. Here's how to check if you're affected and fix it.
2026-07-07 13:55 UTC -
web:support.microsoft.com
Applies to: Windows Server 2016 This security update includes fixes and improvements that are a part of the following update: May 12, 2026—KB5087537 (OS Build 14393.9140) The following is a summary of the issues that this update addresses. The bold text within the brackets indicates the item or area of the change we are documenting. [Secure Boot] This update adds a new policy setting ...
2026-07-07 13:55 UTC -
web:attack.mitre.org
This mitigation can be implemented through the following measures: Regular Operating System Updates Implementation: Apply the latest Windows security updates monthly using WSUS (Windows Server Update Services) or a similar patch management solution. Configure systems to check for updates automatically and schedule reboots during maintenance ...
2026-05-22 08:22 UTC -
web:docs.tenable.com
Cumulative vs. Mitigated Vulnerabilities Tenable Security Center stores vulnerabilities in two databases: the cumulative database and the mitigated database. You can choose to view cumulative vulnerabilities or mitigated vulnerabilities in any vulnerability analysis tool. For more information, see View Cumulative or Mitigated Vulnerabilities. Cumulative Vulnerabilities The cumulative database ...
2026-05-22 08:22 UTC -
web:www.rapid7.com
Microsoft is addressing 70 vulnerabilities this December 2024 Patch Tuesday. Learn more about the vulnerabilities from this month!
2026-05-22 08:22 UTC -
web:support.google.com
Still not working? Get more help on the Chrome Help Forum. Or , learn how to fix problems installing Chrome.
2026-05-22 02:51 UTC -
web:github.com
Patch termsrv.dll so that multiple remote users can open an RDP session on a non-Windows Server computer - fabianosrc/TermsrvPatcher
2026-05-22 02:51 UTC -
web:www.computerworld.com
Each month, the team at Readiness analyzes the latest Patch Tuesday updates from Microsoft and provides detailed, actionable testing guidance. The company's Patch Tuesday release for February ...
2026-05-22 02:51 UTC -
web:www.cve.org
At cve .org, we provide the authoritative reference method for publicly known information-security vulnerabilities and exposures
2026-05-22 02:51 UTC -
web:cybersecuritynews.com
Google released a critical Chrome update fixing multiple high-risk vulnerabilities that could enable arbitrary code execution.
2026-05-22 02:51 UTC -
web:www.oracle.com
This Critical Patch Update contains 481 new security patches across the product families listed below. Please note that an MOS note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at April 2026 Critical Patch Update: Executive Summary and Analysis.
2026-05-22 02:51 UTC -
web:blog.qualys.com
Review Microsoft and Adobe's December 2024 Patch Tuesday updates, addressing critical vulnerabilities and key fixes for enhanced security protection.
2026-05-22 02:51 UTC -
web:www.vicarius.io
Automated Testing: Verifies the upgrade and ensures vulnerability mitigation . Future-Proof: Upgrades to the latest secure version (currently 3.4.0) from the official GitHub repository. Conclusion By automating the upgrade process with this remedy script, you can efficiently secure your systems and containers from CVE - 2024 -9143.
2026-05-22 02:51 UTC -
web:www.tenable.com
Apply risk-based patch management to mitigate threats Close the gap between discovery and remediation . Get vast vulnerability coverage with 250k+ patches to automate prioritization and accelerate SLAs to reduce your exposure in clicks.
2026-05-22 02:51 UTC -
web:portal.msrc.microsoft.com
The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.
2026-05-22 02:51 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.
Raw JSON
The full cvelistV5 record. Download as CVE-2024-12143.json.
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-12143",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-27T18:34:45.471853Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-27T18:34:49.604Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "Mikro Hand Terminal - MikroDB",
"vendor": "Mobilteg Mobile Informatics",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "H\u00fcseyin \u00dcZ\u00dcM"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mobilteg Mobile Informatics Mikro Hand Terminal - MikroDB allows SQL Injection.<p>This issue affects Mikro Hand Terminal - MikroDB. \n\nNOTE: The vendor did not inform about the completion of the fixing process within the specified time. The CVE will be updated when new information becomes available.\n\n</p>"
}
],
"value": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mobilteg Mobile Informatics Mikro Hand Terminal - MikroDB allows SQL Injection.This issue affects Mikro Hand Terminal - MikroDB.\u00a0\n\nNOTE: The vendor did not inform about the completion of the fixing process within the specified time. The CVE will be updated when new information becomes available."
}
],
"impacts": [
{
"capecId": "CAPEC-66",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-66 SQL Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-23T07:38:24.948Z",
"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
"shortName": "TR-CERT"
},
"references": [
{
"url": "https://www.usom.gov.tr/bildirim/tr-25-0142"
}
],
"source": {
"advisory": "TR-25-0142",
"defect": [
"TR-25-0142"
],
"discovery": "UNKNOWN"
},
"title": "SQLi in Mobilteg Mobile Informatics' Mikro Hand Terminal - MikroDB",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
"assignerShortName": "TR-CERT",
"cveId": "CVE-2024-12143",
"datePublished": "2025-06-27T17:00:28.792Z",
"dateReserved": "2024-12-04T11:36:25.030Z",
"dateUpdated": "2025-09-23T07:38:24.948Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}