CVE-2024-48733

SQL injection vulnerability in /SASStudio/sasexec/sessions/{sessionID}/sql in SAS Studio 9.4 allows remote attacker to execute arbitrary SQL commands via the POST body request. NOTE: this is disputed by the vendor because SQL statement execution is allowed for authorized users.

Score

CVSS 3.1 8.8 High

Status

Deferred - cve@mitre.org

Published

2024-10-30

Last modified

2026-07-05

Weaknesses

CWE-89

Affected products

• Studio (Sas)

References

• https://github.com/ACN-CVEs/CVE-2024-48733/blob/ea2da31c3d6e0140edd6a1455e6157b8ba2f7a67/SQL%20injection.pdf
• https://support.sas.com/resources/papers/proceedings18/2387-2018.pdf