CVE-2024-0784 is a medium severity (CVSS 6.3) SQL injection in hongmaple octopus 1.0, through the dataScope argument of /system/role/list, reachable remotely. The project uses a rolling release, so no fixed version is named. Update to the latest code and use parameterised queries.
What's affected
hongmaple octopus 1.0. The affected file is /system/role/list, and the dataScope argument leads to SQL injection. The attack can be launched remotely and an exploit has been disclosed publicly.
The record says the product uses a rolling release for continuous delivery, so no version details for affected or updated releases are available. A fixed version cannot be named from the record.
The record classifies the weakness as CWE-89 (SQL injection). NVD scores it 6.3 (Medium) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L.
The sources differ on severity. The description, from VulDB, calls the issue critical. NVD's CVSS 3.1 score is 6.3 (Medium). Check which of your deployments sit behind a login, because the vector requires some privileges.
How to check if you're exposed
There is no package manager command that answers this one, because the record points to a standalone application or a product that publishes no version history. Start with an inventory question: do you run hongmaple octopus anywhere, including test servers, lab machines and forgotten demo installs?
If you build software from source, search your repositories and artifact stores for the project name. The free in-browser dependency scan can flag known issues in the dependencies it finds, which helps when the component is vendored or pulled in transitively.
What to do now
- Find every deployment of octopus and note the commit or build it was made from.
- Pull the latest upstream code and rebuild. Compare against the report linked in the record to check that the dataScope handling changed.
- Review the code that builds the role list query. Replace string concatenation with parameterised queries and an allow list for any sort or scope fields.
- Restrict database account rights for the application to what it needs, so an injection cannot reach other schemas.
Why it matters
SQL injection (CWE-89) occurs when input becomes part of a query's structure instead of a value. A scope argument is a classic case, because developers sometimes treat it as trusted filter text. Parameter binding cannot cover identifiers or keywords, so those need an allow list.
The impact depends on the database account's rights. A narrowly scoped account limits what an injected query can read or change.
The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and nothing in the record says it is exploited in the wild. That can change, so keep it on your watch list.
Quick check
How do I know if I am patched on a rolling release?
Compare your deployed commit with upstream history and read the change that touched the dataScope handling. A version number cannot answer this.
Sources
The links below are the references listed in the CVE record. The record and its description were the basis for this post, and the vendor advisory remains the authority for fixed versions.
Last reviewed: 19 October 2026.
