CVE-2024-0342 is a medium severity (CVSS 6.3) sql injection weakness in Inis. No fixed version is confirmed in the record, so check the vendor or project page. The record says an exploit has been disclosed to the public. It is not listed as exploited in the wild by CISA.
What's affected
Inis up to and including 2.0.1. The affected file is app/api/controller/default/Sqlite.php and the manipulated argument is sql.
The weakness is mapped to CWE-89, SQL injection. The record was published on 2024-01-09. The record's KEV flag is false, so CISA does not list it in the Known Exploited Vulnerabilities catalog.
The sources disagree on severity. The description, which comes from VulDB, calls the issue critical. NVD's CVSS 3.1 score is 6.3, which is Medium, with the vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. Both ratings are published. Plan around the rating that matches your exposure: an internet facing copy deserves the more urgent reading.
How to check if you're exposed
This is software you install yourself or an appliance, so start from your own inventory. Find where the product runs, read its version from the application, its package metadata or its install directory, and compare it to the range above.
grep -ril "'+d['short'].split('-')[0]+'" /var/www 2>/dev/null
That searches a typical web root for the product name, so adjust the path to your server. For code you maintain, search for the file and parameter named in the record and read how the value is used.
You can also paste a manifest or SBOM into the free in-browser scanner at Safeguard Gold to see which known CVEs apply to your dependencies. It only covers components that appear in a manifest or SBOM, so a standalone appliance still needs the manual check.
What to do now
- Find every deployment of Inis in your environment, including test systems and anything bought or installed by a team outside IT.
- Check the vendor or project page for a fixed release. None is confirmed in the record, so do not assume that upgrading to the latest version resolves it until the notes say so.
- Search the code for the named parameter and for any query string built by concatenation.
- Run the database account for this app with only the rights it needs, so a successful injection reaches as little as possible.
- Put a web application firewall rule or reverse proxy filter in front of the app as a stop gap, and treat it as temporary.
- Re-run a scan after the change and record the date, so you can show the exposure is closed.
Why it matters
SQL injection happens when input from a request is placed into a database query without being kept separate from the query structure. The application then lets a caller change what the query does. Depending on the database account in use, that can mean reading rows that should be private, changing data, or in some setups going further.
The durable fix is parameterized queries, also called prepared statements, with input validated as a second layer. Escaping by hand is the approach that keeps failing. If you maintain a copy of this code, search every place that builds a query from request values, not just the one named in the record.
The CVSS vector reads as follows. The attack is possible from an adjacent network, attack complexity is low, privileges required are none, and user interaction is not needed. The impact on confidentiality, integrity and availability is limited, limited and limited respectively. A score is a starting point. Your own exposure, meaning whether the product faces the internet and what it can reach, decides the real priority.
Quick check
Is this vulnerability known to be exploited in the wild?
The record's KEV flag is false, so CISA does not list it in the Known Exploited Vulnerabilities catalog. The description says an exploit has been disclosed to the public, which is not the same as confirmed attacks. Treat the public disclosure as a reason to act sooner.
Which versions are fixed?
The record does not confirm a fixed version, and the vendor reference could not be retrieved. Check the vendor or project page, and if none is available, restrict access to the product or replace it.
Sources
The vendor and researcher references listed in the NVD record could not be retrieved when this post was written, so the details above come from the NVD record itself.
Last reviewed: 19 October 2026.
