What’s Vulnerable › Vulnerabilities

CVE-2024-43415: Decidim-Awesome: SQL injection in AdminAccountability

• Severity: critical (CVSS 9.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-11-12 · updated 2026-06-17
• Weakness: CWE-89

Description

An improper neutralization of special elements used in an SQL command in the papertrail/version- model of the decidim_awesome-module <= v0.11.1 (> 0.9.0) allows an authenticated admin user to manipulate sql queries to disclose information, read and write files or execute commands.

Affected products

• Decidim International Community Environment Decidim-Module-Decidim Awesome: through 0.9.1; before 0.10.3; through 0.11.0; before 0.11.2 — fixed in 0.10.3, 0.11.2

How to fix

Upgrade to a fixed version: Decidim International Community Environment Decidim-Module-Decidim Awesome 0.10.3, 0.11.2. Check the vendor advisory for mitigations.

References

• https://github.com/decidim-ice/decidim-module-decidim_awesome/commit/84374037d34a3ac80dc18406834169c65869f11b
• https://github.com/decidim-ice/decidim-module-decidim_awesome/security/advisories/GHSA-cxwf-qc32-375f
• https://pentest.ait.ac.at/security-advisory/decidim-awesome-sql-injection-in-adminaccountability

Get alerted when CVE-2024-43415 or the next vulnerability affects your stack