================================================================================ FICTIONAL CVE ENTRIES — EDUCATIONAL EXAMPLES ONLY These are fabricated CVE entries in NVD-style format for training purposes. None of these CVE IDs, products, or vendors are real. ================================================================================ CVE-2024-90001 ============== Description: Stack-based buffer overflow in NexusWebServer version 3.2.1 and earlier. The HTTP request handler in http_parse_headers() copies the User-Agent header value into a fixed-size 256-byte stack buffer using strcpy() without length validation. A remote, unauthenticated attacker can send a crafted HTTP request with an oversized User-Agent header to overflow the buffer, overwrite the saved return address, and achieve arbitrary code execution in the context of the web server process. Affected Product: NexusWebServer Affected Versions: <= 3.2.1 Fixed Version: 3.2.2 Vendor: Nexus Systems Inc. (fictional) CVSS v3.1 Score: 9.8 (Critical) CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High CWE: CWE-121 (Stack-based Buffer Overflow) Exploit Available: Yes (proof-of-concept on Exploit-DB) Patch Available: Yes References: - https://fictional-nexus.example.com/security/advisory-2024-001 - https://fictional-exploitdb.example.com/exploits/51234 - https://fictional-nvd.example.com/vuln/CVE-2024-90001 Timeline: 2024-01-15 Vulnerability discovered by researcher 2024-01-18 Vendor notified via security@nexus-systems.example.com 2024-02-20 Patch released in version 3.2.2 2024-02-25 Public disclosure and CVE assignment -------------------------------------------------------------------------------- CVE-2024-90002 ============== Description: SQL injection vulnerability in CloudDash Admin Panel version 5.4.0 through 5.7.2. The /api/v2/users endpoint accepts a "sort_by" query parameter that is concatenated directly into a SQL ORDER BY clause without sanitization or parameterized queries. An authenticated attacker with low-privilege (viewer) access can inject arbitrary SQL statements to extract sensitive data from the database, including password hashes, API keys, and session tokens of other users including administrators. Affected Product: CloudDash Admin Panel Affected Versions: 5.4.0 through 5.7.2 Fixed Version: 5.7.3 Vendor: CloudDash Technologies (fictional) CVSS v3.1 Score: 8.8 (High) CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Attack Vector: Network Attack Complexity: Low Privileges Required: Low (authenticated viewer account) User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High (can modify data via stacked queries) Availability: High (DROP/TRUNCATE possible) CWE: CWE-89 (SQL Injection) Exploit Available: Yes (sqlmap tamper script available) Patch Available: Yes References: - https://fictional-clouddash.example.com/security/SA-2024-003 - https://fictional-hackerone.example.com/reports/1234567 - https://fictional-nvd.example.com/vuln/CVE-2024-90002 Proof of Concept (sanitized): GET /api/v2/users?sort_by=username;SELECT+pg_sleep(5)-- Response delayed by 5 seconds confirms time-based blind SQL injection. Timeline: 2024-03-10 Discovered during authorized penetration test 2024-03-12 Vendor notified via bug bounty program 2024-04-01 Patch released in version 5.7.3 2024-04-15 Public disclosure -------------------------------------------------------------------------------- CVE-2024-90003 ============== Description: Insecure deserialization vulnerability in DataPipeline Java SDK version 2.0.0 through 2.3.4. The SDK's JobConfig.loadFromNetwork() method accepts serialized Java objects over an unauthenticated HTTP endpoint on port 8500 and deserializes them using ObjectInputStream without class filtering or allowlisting. An attacker with network access to the DataPipeline service port can send a crafted serialized object (e.g., using ysoserial gadget chains for Commons Collections) to achieve remote code execution as the service account running the DataPipeline worker process. Affected Product: DataPipeline Java SDK Affected Versions: 2.0.0 through 2.3.4 Fixed Version: 2.4.0 Vendor: DataPipeline Corp (fictional) CVSS v3.1 Score: 9.8 (Critical) CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High CWE: CWE-502 (Deserialization of Untrusted Data) Exploit Available: Yes (ysoserial gadget chain) Patch Available: Yes (version 2.4.0 adds ObjectInputFilter allowlist) References: - https://fictional-datapipeline.example.com/security/DSA-2024-007 - https://fictional-github.example.com/datapipeline/sdk/security/advisories/GHSA-xxxx-yyyy - https://fictional-nvd.example.com/vuln/CVE-2024-90003 Technical Details: Vulnerable code path: JobConfig.loadFromNetwork() -> HttpClient.getObject(url) -> new ObjectInputStream(response.getBody()) -> ObjectInputStream.readObject() // <-- no class filter Exploitation requires: 1. Network access to port 8500 of a DataPipeline worker node 2. A compatible gadget chain in the application's classpath (Commons Collections 3.x confirmed vulnerable) 3. Generate payload: java -jar ysoserial.jar CommonsCollections6 'cmd' Fix in 2.4.0: - Replaced ObjectInputStream with JSON-based configuration format - Added authentication requirement for the config endpoint - Legacy mode (if enabled) uses ObjectInputFilter allowlist Timeline: 2024-05-01 Vulnerability identified during code audit 2024-05-03 Vendor notified via security@datapipeline.example.com 2024-06-15 Patch released in version 2.4.0 2024-06-20 Public disclosure and CVE assignment ================================================================================ END OF FICTIONAL CVE ENTRIES — FOR EDUCATIONAL / CTF USE ONLY ================================================================================