CVE-2024-1576 is a critical (CVSS 9.8) SQL injection in MegaBIP software, through version 5.09. An attacker can obtain site administrator privileges, including access to the administration panel and the ability to change the administrator password. CERT Polska coordinated the disclosure. Upgrade past 5.09.
What's affected
CERT Polska's advisory, published on 12 June 2024, lists the vendor as Jan Syski, the product as MegaBIP, and the vulnerable versions as all through 5.09. That matches the NVD record.
The same advisory covers two sibling issues: CVE-2024-1577, code injection through 5.11.2, and CVE-2024-1659, unrestricted file upload through 5.10. The advisory shows a fixed version is not stated in the text I read, so check the vendor site at megabip.pl for the current release.
MegaBIP is used for Polish public information bulletins, and the Polish government has issued a recommendation about them, which the record links.
How to check if you're exposed
Check the version in the MegaBIP administration panel or the footer of the site. Anything through 5.09 is affected for this issue, and anything through 5.11.2 for CVE-2024-1577.
Review administrator accounts and recent password changes. Check your web server logs for odd requests to the pages that take identifiers or search terms.
To check a whole codebase at once, run the free in-browser dependency scan at gold.safeguard.sh/scan. You can also look up the CVE in the Gold directory, and use reachability analysis to see whether your code calls the affected path.
What to do now
- Confirm the MegaBIP version.
- Upgrade to the latest release from the vendor, which should be newer than 5.11.2.
- Review administrator accounts and reset passwords.
- Check the site for unfamiliar files or changed pages.
- Read the Polish government recommendation for public information bulletins.
Why it matters
The record classes this as CWE-89, SQL injection. User input reached a database query, and the attacker could read or change data to take over the administrator account.
An administrator takeover on a public website means defacement, data access, and a base for further steps. The score of 9.8 follows from network access with no authentication. The record's KEV flag is false.
Quick check
Are there related MegaBIP issues?
Yes. CVE-2024-1577 and CVE-2024-1659 are listed in the same CERT Polska advisory.
Who found these?
CERT Polska lists its own research as the source.
Sources
- CERT Polska advisory
- MegaBIP vendor site (listed in the NVD record, not retrieved)
- NVD record data for CVE-2024-1576
Last reviewed: 19 October 2026.
