CVE-2024-29872 — AI Deep Analysis Summary

🚨 **Essence**: SQL Injection in Sentrifugo HRMS. 💥 **Consequences**: Attackers can extract **ALL** data from the server via the `agencyids` parameter in `/sentrifugo/index.php/empscreening/add`.

🛡️ **Root Cause**: **CWE-89** (SQL Injection). The flaw lies in improper input validation of the `agencyids` parameter, allowing malicious SQL queries.

👥 **Affected**: **Sentrifugo** HR Management System. Specifically **Version 3.2**. Includes HR, performance, recruitment, and asset management modules.

💀 **Hackers' Power**: **Full Data Extraction**. They can send crafted queries to steal sensitive HR data. High impact on Confidentiality, Integrity, and Availability.

⚡ **Exploitation**: **Low Threshold**. CVSS Vector: `AV:N/AC:L/PR:N/UI:N`. No authentication required (`PR:N`), no user interaction (`UI:N`). Easy to exploit remotely.

📢 **Public Exp?**: **No PoC listed** in the provided data. However, the vulnerability is well-defined. Wild exploitation is likely due to low complexity.

🔍 **Self-Check**: Scan for Sentrifugo v3.2. Check if `/sentrifugo/index.php/empscreening/add` is accessible. Test `agencyids` parameter for SQL injection responses.

🩹 **Fix**: Official patch info not explicitly detailed in the snippet, but the vendor (Incibe CERT) has issued a notice. **Update** to the latest secure version immediately.

🚧 **No Patch?**: **Mitigation**: Restrict access to `/sentrifugo/index.php/empscreening/add`. Implement WAF rules to block SQL injection patterns in `agencyids`.

🔥 **Urgency**: **CRITICAL**. CVSS Score is High (implied by H/H/H metrics). Remote, unauthenticated, full data loss. **Patch NOW**.