CVE-2024-48733: Sas Studio

High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days.

SQL injection vulnerability in /SASStudio/sasexec/sessions/{sessionID}/sql in SAS Studio 9.4 allows remote attacker to execute arbitrary SQL commands via the POST body request. NOTE: this is disputed by the vendor because SQL statement execution is allowed for authorized users.

Affected products

• Sas Studio: version 9.4 only

Published 2024-10-30. Last modified 2026-07-05.