CVE-2024-27718 Scanner

The Smart s200 Management Platform by Baizhuo Network is a comprehensive network management solution used by enterprises to monitor, configure, and automate network devices. IT administrators rely on it for real-time traffic analysis, device health checks, and centralized control, making it a backbone for organizational network operations. Its web-based interface provides dashboards and reporting tools that simplify complex network tasks.

CVE-2024-27718 is a SQL injection vulnerability that arises when user-supplied input is improperly sanitized before being used in database queries. This flaw occurs due to insufficient validation of input fields, allowing attackers to inject malicious SQL commands. The vulnerability is particularly dangerous because it can be exploited remotely without authentication, increasing its risk profile.

The vulnerable endpoint is the login page at /login.php, specifically the 'username' parameter. An attacker can submit crafted SQL payloads in this field to manipulate the backend query, bypass authentication, or extract sensitive data. The injection point is directly concatenated into a SELECT statement, enabling time-based or error-based exploitation techniques.

Successful exploitation can lead to unauthorized access to the management platform, exposure of stored credentials, device configurations, and network topology data. Attackers could escalate privileges, modify device settings, or disrupt network operations. In worst-case scenarios, this could result in full network compromise, data breaches, and significant operational downtime.