Security researchers have uncovered a severe vulnerability in BigAnt Office Messenger version 5.6.06, tracked as CVE-2024-54761. This flaw has a CVSS score of 9.8, which places it in the “critical” category.
The vulnerability exists due to improper handling of user-supplied input, leaving the system open to SQL injection. In practical terms, this means an attacker can manipulate database queries in ways the developers never intended. Even more concerning, this vulnerability can be chained into remote code execution (RCE) — giving attackers the ability to run arbitrary commands on the affected server.
Potential Impact
If successfully exploited, attackers could:
- Gain unauthorized access to sensitive data stored in the database
- Escalate privileges to administrative levels
- Upload and execute malicious files (e.g., backdoors)
- Fully compromise the BigAnt Office Messenger server
Who Is at Risk?
Any organization running BigAnt Office Messenger version 5.6.06 (or earlier, if applicable) is vulnerable. The exploit has been tested specifically on version 5.6.06, but it’s strongly advised to consider older releases untrusted unless verified safe.
How to Protect Your Systems?
- Update immediately – Apply the latest security patch from the vendor (BigAntSoft).
- Restrict network access – Limit access to the BigAnt Office Messenger server only to trusted internal IPs.
- Monitor logs – Watch for unusual queries or suspicious file creation events.
- Harden your database – Disable unnecessary permissions and enforce the principle of least privilege.
- Regular backups – Keep secure backups to recover quickly in case of compromise.
This vulnerability is a reminder that internal communication tools can also be high-value targets. Because BigAnt Office Messenger often runs in corporate environments, attackers who exploit this flaw could gain a foothold into broader networks.
Staying updated, enforcing strict access controls, and monitoring actively are the best defenses against threats like CVE-2024-54761.
More: https://www.exploit-db.com/exploits/52412
