CVE-2024-48733

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-10-30 · updated 2026-07-05
Weakness: CWE-89

Description

SQL injection vulnerability in /SASStudio/sasexec/sessions/{sessionID}/sql in SAS Studio 9.4 allows remote attacker to execute arbitrary SQL commands via the POST body request. NOTE: this is disputed by the vendor because SQL statement execution is allowed for authorized users.

Affected products

Sas Studio: 9.4

References

https://github.com/ACN-CVEs/CVE-2024-48733/blob/ea2da31c3d6e0140edd6a1455e6157b8ba2f7a67/SQL%20injection.pdf
https://support.sas.com/resources/papers/proceedings18/2387-2018.pdf

Get alerted when CVE-2024-48733 or the next vulnerability affects your stack