{"id":"CVE-2024-5276","published":"2024-06-25T19:13:54Z","modified":"2024-08-01T21:11:12Z","title":"SQL Injection Vulnerability in FileCatalyst Workflow 5.1.6 Build 135 (and earlier)","vendor":"Fortra","product":"FileCatalyst Workflow","tier":"core","eol":null,"affectedVersions":[{"vendor":"Fortra","product":"FileCatalyst Workflow","versions":["5.1.6; 0"]}],"description":{"text":"A SQL Injection vulnerability in Fortra FileCatalyst Workflow allows an attacker to modify application data.  Likely impacts include creation of administrative users and deletion or modification of data in the application database. Data exfiltration via SQL injection is not possible using this vulnerability. Successful unauthenticated exploitation requires a Workflow system with anonymous access enabled, otherwise an authenticated user is required. This issue affects all versions of FileCatalyst Workflow from 5.1.6 Build 135 and earlier.","provenance":"source","from":"CVE.org"},"summary":{"text":"A SQL injection flaw in Fortra FileCatalyst Workflow, affecting version 5.1.6 Build 135 and earlier, allows an attacker to modify application data, potentially including creating administrative users and altering or deleting records in the application database, though data exfiltration is not possible. Exploitation is network-reachable and requires no authentication or user interaction where the Workflow system has anonymous access enabled; otherwise, the attacker must be an authenticated user.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-31T05:10:49Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.90067,"percentile":0.99794,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2025-10-17","exploitedFirstSeen":"2026-09-10","ransomware":false,"evidence":[{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-10&host_type=src&vulnerability=cve-2024-5276","date":"2026-09-10"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-11&host_type=src&vulnerability=cve-2024-5276","date":"2026-09-11"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-12&host_type=src&vulnerability=cve-2024-5276","date":"2026-09-12"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-14&host_type=src&vulnerability=cve-2024-5276","date":"2026-09-14"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-16&host_type=src&vulnerability=cve-2024-5276","date":"2026-09-16"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-17&host_type=src&vulnerability=cve-2024-5276","date":"2026-09-17"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-18&host_type=src&vulnerability=cve-2024-5276","date":"2026-09-18"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-21&host_type=src&vulnerability=cve-2024-5276","date":"2026-09-21"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-22&host_type=src&vulnerability=cve-2024-5276","date":"2026-09-22"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-25&host_type=src&vulnerability=cve-2024-5276","date":"2026-09-25"}],"evidenceTotal":18,"provenance":"source"},"exploited":true,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[{"id":"CWE-20","name":"Improper Input Validation"},{"id":"CWE-89","name":"Improper Neutralization of Special Elements used in an SQL Command"}],"references":[{"url":"https://support.fortra.com/filecatalyst/kb-articles/advisory-6-24-2024-filecatalyst-workflow-sql-injection-vulnerability-YmYwYWY4OTYtNTUzMi1lZjExLTg0MGEtNjA0NWJkMDg3MDA0","tags":[]},{"url":"https://www.fortra.com/security/advisory/fi-2024-008","tags":[]},{"url":"https://www.tenable.com/security/research/tra-2024-25","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2024-46512","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-46512","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"metasploit":[{"name":"Fortra FileCatalyst Workflow SQL Injection (CVE-2024-5276)","module":"auxiliary/admin/http/fortra_filecatalyst_workflow_sqli","type":"auxiliary","disclosureDate":"2024-06-25","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/fortra_filecatalyst_workflow_sqli.rb"}],"nuclei":[{"id":"CVE-2024-5276","name":"Fortra FileCatalyst Workflow <= v5.1.6 - SQL Injection","severity":"critical","path":"http/cves/2024/CVE-2024-5276.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-5276.yaml"}],"first":{"date":"2024-06-25","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/fortra_filecatalyst_workflow_sqli.rb"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2024-06-25","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2024-5276","provenance":"source"},{"date":"2024-06-25","kind":"exploit-public","label":"First public exploit: Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/fortra_filecatalyst_workflow_sqli.rb","provenance":"source"},{"date":"2026-09-10","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-10&host_type=src&vulnerability=cve-2024-5276","provenance":"source"}],"speed":{"daysToPublicExploit":0,"firstExploitFrom":"Metasploit","daysToKev":null},"priority":{"score":66.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 379 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.96,"detail":"percentile 0.9979"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}