{"vulnerability": "CVE-2024-42533", "sightings": [{"uuid": "674894a3-df4f-4101-aba0-aa7ae6d45453", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-42533", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3ll7q2zs5zb2m", "content": "", "creation_timestamp": "2025-03-25T16:49:45.843556Z"}, {"uuid": "dac095ca-9a5e-459b-bb36-74624426fa2a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-42533", "type": "seen", "source": "https://bsky.app/profile/darkwebinformer.bsky.social/post/3ll7uap4rzc2c", "content": "", "creation_timestamp": "2025-03-25T18:04:30.188631Z"}, {"uuid": "b26a3fd1-75d3-4187-ab7a-399ea23c0828", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-42533", "type": "seen", "source": "https://gist.github.com/7h30th3r0n3/eae27e0eed39741365c55dfd46b57dc8", "content": "", "creation_timestamp": "2025-03-25T10:15:42.000000Z"}, {"uuid": "0dbf89a2-c690-44b4-88b4-5e105c98a660", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-42533", "type": "seen", "source": "MISP/3e4b778d-5810-4171-a915-f1d106684af4", "content": "", "creation_timestamp": "2025-08-11T18:27:48.000000Z"}, {"uuid": "d421828f-d42b-45fa-986a-1b0924e5446b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-42533", "type": "seen", "source": "https://t.me/DarkWebInformer_News/2434", "content": "\ud83d\udea8 News Alert!\n\nSource: Dark Web Informer - Cyber Threat Intelligence\nTitle: CVE-2024-42533: SQL Injection in StandVoice by Convivance\nLink: https://darkwebinformer.com/cve-2024-42533-sql-injection-in-standvoice-by-convivance/", "creation_timestamp": "2025-03-25T18:04:33.000000Z"}, {"uuid": "d801ef80-36b3-4a2d-a180-1c3c26b5e393", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-42533", "type": "seen", "source": "https://t.me/cvedetector/21111", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-42533 - Convivance StandVoice SQL Injection\", \n  \"Content\": \"CVE ID : CVE-2024-42533 \nPublished : March 25, 2025, 2:15 p.m. | 1\u00a0hour, 46\u00a0minutes ago \nDescription : SQL injection vulnerability in the authentication module in Convivance StandVoice 4.5 through 6.2 allows remote attackers to execute arbitrary code via the GEST_LOGIN parameter. \nSeverity: 9.8 | CRITICAL \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"25 Mar 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-03-25T17:49:21.000000Z"}, {"uuid": "5eb16b0f-b71f-4a74-8962-5b67014bfa46", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-42533", "type": "published-proof-of-concept", "source": "https://t.me/TheDarkWebInformer/15358", "content": "\ud83d\udea8CVE-2024-42533: SQL Injection in StandVoice by Convivance\n\nhttps://darkwebinformer.com/cve-2024-42533-sql-injection-in-standvoice-by-convivance/", "creation_timestamp": "2025-03-25T19:04:13.000000Z"}, {"uuid": "f6aa4b74-3404-4c15-ad70-50ead859ac14", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-42533", "type": "seen", "source": "https://gist.github.com/7h30th3r0n3/d3063b5d02a41745bc5f2e4b44b272c1", "content": "# CVE-2026-39192 \u2013 Sensitive File Exposure in StandVoice by Conviviance\n\n**Product**: StandVoice  \n**Vendor**: Conviviance  \n**Versions Affected**: 6.2 and before  \n**Vulnerability Type**: Incorrect Access Control (CWE-540, CWE-312, CWE-532, CWE-548)  \n**CVE ID**: CVE-2026-39192  \n**Related**: CVE-2024-42533 (exposed source code reveals all SQLi entry points from that advisory)  \n**Reporter**: 7h30th3r0n3 \u2013 OSINX  \n**CVSS v3.1 Base Score**: 7.5 (High)  \n**Vector**: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`\n\n---\n\n## Description\n\nStandVoice by Conviviance (version 6.2 and before) exposes sensitive files to unauthenticated remote attackers due to Apache misconfiguration. Directory listing is enabled and `.inc` PHP files are served as plaintext on multiple directories, allowing any remote attacker to browse and download all exposed files via simple HTTP GET requests.\n\n**Sensitive data exposed includes:**\n\n- **MySQL credentials** in `/Init/init.inc` (user: `CDBE`, database: `Conviviance`) in cleartext\n- **Google Cloud Platform service account private key** in `/Init/credentials.json` (project: `projet1-dev`), enabling potential access to associated cloud resources\n- **Google Sheets** spreadsheet ID and API integration details\n- **50+ PHP source files** in `/Includes/` with complete application logic (database abstraction layer, authentication logic, Windows Registry access classes, and all business logic)\n- **Log files** in `/Log/` containing complete SQL queries with schema information, user login attempts with credentials in cleartext, session identifiers and internal file paths\n- **log4php configuration** in `/Init/config.xml` confirming TRACE level logging with 100-file retention\n- **Internal Windows file paths** and server configuration details\n\nThe combination of exposed database credentials and source code effectively provides full unauthenticated access to the application backend. This vulnerability is related to CVE-2024-42533 as the exposed source code reveals all SQL injection entry points exploited in that advisory.\n\n---\n\n## Technical Details\n\n**Root Cause:**\n- Apache is configured to serve `.inc` files as `text/plain` instead of interpreting them as PHP.\n- Directory listing (`Options +Indexes`) is enabled on sensitive directories.\n\n**Affected Paths:**\n\n| Path | Content | CWE |\n| --- | --- | --- |\n| `/Init/init.inc` | MySQL server, username, password, database name in cleartext | CWE-540, CWE-312 |\n| `/Init/credentials.json` | Full GCP service account private key | CWE-540 |\n| `/Init/config.xml` | log4php config with TRACE level, 100-file retention | CWE-540 |\n| `/Includes/` | 50+ `.inc` source files (~1 MB total application logic) | CWE-540 |\n| `/Log/` | Rotating log files with SQL queries, credentials, sessions | CWE-532 |\n\n**Attack Vector:**\n- Unauthenticated HTTP GET requests only.\n- No interaction, authentication, or special tools required.\n\n---\n\n## Impact\n\n- **Credential Exposure**: Database credentials and GCP service account key exposed in cleartext.\n- **Source Code Disclosure**: Complete application logic available for analysis, enabling targeted exploitation of further vulnerabilities.\n- **Cloud Resource Compromise**: GCP private key allows potential access to associated cloud project resources.\n- **User Data Leakage**: Log files contain user credentials, session identifiers, and full SQL queries.\n- **Full Reconnaissance**: Exposed source code, configuration, and logs provide complete knowledge of the application architecture.\n\n---\n\n## Timeline\n\n>     June 14, 2024: Discovery of related SQL injection vulnerability (CVE-2024-42533).\n>     June 17, 2024: Initial vulnerability report sent to Conviviance.\n>     June 25, 2024: Conviviance confirms patch available in latest version above 6.x.\n>     2026: Discovery of sensitive file exposure and Apache misconfiguration.\n>     August 26, 2026: CVE-2026-39192 assigned by MITRE.\n\n_Disclosure timestamp: 2026-08-26_\n\n---\n\n## References\n\n- [CVE-2024-42533 \u2013 SQL Injection Advisory](https://gist.github.com/7h30th3r0n3/eae27e0eed39741365c55dfd46b57dc8)\n- [Conviviance](http://conviviance.com)\n- [StandVoice](http://standvoice.com)\n\n---\n\n## Discoverer / Credits\n\nReported by **7h30th3r0n3** \u2013 [OSINX](https://osinx.fr)\n", "creation_timestamp": "2026-08-26T08:09:19.663073Z"}, {"uuid": "fc3abe48-6c8f-42c9-9a23-5ae1e27d7ce5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-42533", "type": "seen", "source": "https://gist.github.com/7h30th3r0n3/0417c90c483638a47c269ca535dfae99", "content": "# CVE-2026-39191 \u2013 SQL Injection to RCE in StandVoice by Conviviance\n\n**Product**: StandVoice  \n**Vendor**: Conviviance  \n**Versions Affected**: 4.5 through 6.2  \n**Vulnerability Type**: SQL Injection / Code Injection (CWE-89, CWE-94)  \n**CVE ID**: CVE-2026-39191  \n**Related**: CVE-2024-42533 (same SQLi entry point, different exploitation technique and impact)  \n**Reporter**: 7h30th3r0n3 \u2013 OSINX  \n**CVSS v3.1 Base Score**: 10.0 (Critical)  \n**Vector**: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`\n\n---\n\n## Description\n\nA critical SQL Injection vulnerability in the authentication module of Conviviance StandVoice (versions 4.5 through 6.2) allows a remote, unauthenticated attacker to achieve arbitrary code execution. By injecting a `UNION SELECT \u2026 INTO OUTFILE` payload into the `Login` parameter (`GEST_LOGIN` field) of `Identification.php`, an attacker can write a PHP webshell directly to the web root. The webshell is then executed with **NT AUTHORITY\\SYSTEM** privileges, resulting in full system compromise.\n\nThis vulnerability is related to CVE-2024-42533 which covers the same SQL injection entry point but was limited to authentication bypass. CVE-2026-39191 demonstrates a different exploitation technique escalating from SQL injection to remote code execution.\n\n---\n\n## Technical Details\n\n**Injection Point:**\n- **Endpoint**: `POST /Identification.php?TYPE=Master`\n- **Parameter**: `Login` (`GEST_LOGIN` field)\n- **Authentication Required**: None\n\n**Exploitation Chain:**\n\n1. The `Login` parameter is passed unsanitized into a SQL query.\n2. Using a `UNION SELECT` statement combined with `INTO OUTFILE`, the attacker writes arbitrary PHP code to the web-accessible directory.\n3. The written PHP file acts as a webshell, accessible via a direct HTTP request.\n4. The webshell executes commands as **NT AUTHORITY\\SYSTEM** (the service account running the web server on Windows).\n\n**Impact Summary:**\n\n- **Remote Code Execution**: Arbitrary OS commands via webshell.\n- **Privilege Escalation**: Code runs as NT AUTHORITY\\SYSTEM.\n- **Full System Compromise**: Complete control over the affected server.\n\n---\n\n## Impact\n\n- **Code Execution**: Arbitrary command execution on the underlying operating system.\n- **Privilege Escalation**: Webshell runs with the highest Windows privilege level (SYSTEM).\n- **Data Exfiltration**: Full read access to all files and databases on the server.\n- **Lateral Movement**: Compromised server can be used as a pivot point for further attacks.\n\n---\n\n## Timeline\n\n>     June 14, 2024: Discovery of the original SQL injection vulnerability (CVE-2024-42533).\n>     June 17, 2024: Initial vulnerability report sent to Conviviance.\n>     June 25, 2024: Conviviance confirms patch available in latest version above 6.x.\n>     August 23, 2024: CVE-2024-42533 assigned.\n>     2026: Discovery of RCE exploitation technique on the same injection point.\n>     August 26, 2026: CVE-2026-39191 assigned by MITRE.\n\n_Disclosure timestamp: 2026-08-26_  \n_The SQL injection has been patched in versions above 6.x._\n\n---\n\n## References\n\n- [CVE-2024-42533 \u2013 Original SQL Injection Advisory](https://gist.github.com/7h30th3r0n3/eae27e0eed39741365c55dfd46b57dc8)\n- [Conviviance](http://conviviance.com)\n- [StandVoice](http://standvoice.com)\n\n---\n\n## Discoverer / Credits\n\nReported by **7h30th3r0n3** \u2013 [OSINX](https://osinx.fr)\n", "creation_timestamp": "2026-08-26T08:09:19.724064Z"}]}