CVE-2024-2722 is a SQL injection in the CIGESv2 system, through /ajaxConfigTotem.php in the id parameter, scored Critical at 9.8. Severity is Critical at 9.8. No fixed version is named in the record, so check the INCIBE notice and the vendor.
What's affected
- CIGESv2, listed in the record as version 2.0 from ATI Soluciones.
- The affected file is /ajaxConfigTotem.php and the parameter is id.
- No fixed version is named in the NVD record. Check the vendor or the advisory linked in Sources before assuming a patch exists.
The NVD record gives a CVSS score of 9.8 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Published 2024-03-22.
How to check if you're exposed
- Confirm whether CIGESv2 is deployed and which version it runs.
- Search web server logs for requests to ajaxConfigTotem.php; for example
grep -F "ajaxConfigTotem.php" /var/log/apache2/access.log, adjusted to your server. - Review database logs for errors from malformed queries.
- Read the INCIBE notice named in Sources.
What to do now
- Inventory CIGESv2 deployments and note the version.
- Check the INCIBE notice and contact the vendor for a patched release.
- Restrict access to trusted networks until a fix is confirmed.
- Reduce the database account's privileges.
- Review logs for the affected path, and rotate stored credentials if you see suspicious access.
If this software reaches you as part of something you build, the free in-browser dependency scan at gold.safeguard.sh/scan lists known vulnerabilities in your manifests, and reachability analysis helps you see which ones your code can actually trigger.
Why it matters
The vector shows network access, no privileges and no user interaction, which is why the score is 9.8. The record says a remote user could retrieve all data stored in the database. SQL injection stays common because it comes down to how each query is built, one endpoint at a time. Three endpoints in this product were reported together: CVE-2024-2722, CVE-2024-2723 and CVE-2024-2724.
The record tags the weakness as CWE-89. See the Gold pages for more on the class.
SQL injection happens when input from a request is placed into a database query without being kept separate from the query itself. The database then treats part of the input as instructions. The usual defence is parameterised queries, plus a database account that can only do what the application needs.
The record's Known Exploited Vulnerabilities flag is false, so CISA has not listed it as exploited.
The Spanish national cybersecurity institute published the notice that groups these flaws.
Quick check
Does the attacker need to log in?
The CVSS vector lists no privileges required, so according to the record a login is not needed.
Sources
I did not retrieve the pages above when preparing this post, either because they blocked automated access or because I relied on the NVD record. The details here come from that record, so read the linked reference for the original wording.
Last reviewed: 19 October 2026.
