cve/2024/CVE-2024-43415.md

### [CVE-2024-43415](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-43415)
![](https://img.shields.io/static/v1?label=Product&message=decidim-module-decidim_awesome&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3D%20%3E%3D%200.9.1%2C%20%3C%200.10.3%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-89%3A%20Improper%20Neutralization%20of%20Special%20Elements%20used%20in%20an%20SQL%20Command%20('SQL%20Injection')&color=brighgreen)

### Description

An improper neutralization of special elements used in an SQL command in the papertrail/version- model of the decidim_awesome-module <= v0.11.1 (> 0.9.0) allows an authenticated admin user to manipulate sql queries to disclose information, read and write files or execute commands.

### POC

#### Reference
- https://pentest.ait.ac.at/security-advisory/decidim-awesome-sql-injection-in-adminaccountability

#### Github
No PoCs found on GitHub currently.