mirror of
https://github.com/CVEProject/cvelist.git
synced 2025-08-04 08:44:25 +00:00
127 lines
4.8 KiB
JSON
127 lines
4.8 KiB
JSON
{
|
|
"data_version": "4.0",
|
|
"data_type": "CVE",
|
|
"data_format": "MITRE",
|
|
"CVE_data_meta": {
|
|
"ID": "CVE-2024-28145",
|
|
"ASSIGNER": "security-research@sec-consult.com",
|
|
"STATE": "PUBLIC"
|
|
},
|
|
"description": {
|
|
"description_data": [
|
|
{
|
|
"lang": "eng",
|
|
"value": "An unauthenticated attacker can perform an SQL injection by accessing the /class/dbconnect.php\u00a0file and supplying malicious GET parameters. The HTTP GET parameters search, table, field, and value are vulnerable. For example, one SQL injection can be performed on the parameter \"field\" with the UNION keyword."
|
|
}
|
|
]
|
|
},
|
|
"problemtype": {
|
|
"problemtype_data": [
|
|
{
|
|
"description": [
|
|
{
|
|
"lang": "eng",
|
|
"value": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
|
|
"cweId": "CWE-89"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
"affects": {
|
|
"vendor": {
|
|
"vendor_data": [
|
|
{
|
|
"vendor_name": "Image Access GmbH",
|
|
"product": {
|
|
"product_data": [
|
|
{
|
|
"product_name": "Scan2Net",
|
|
"version": {
|
|
"version_data": [
|
|
{
|
|
"version_value": "not down converted",
|
|
"x_cve_json_5_version_data": {
|
|
"versions": [
|
|
{
|
|
"changes": [
|
|
{
|
|
"at": "7.40",
|
|
"status": "unaffected"
|
|
}
|
|
],
|
|
"lessThan": "7.40",
|
|
"status": "affected",
|
|
"version": "0",
|
|
"versionType": "custom"
|
|
}
|
|
],
|
|
"defaultStatus": "affected"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
}
|
|
]
|
|
}
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"references": {
|
|
"reference_data": [
|
|
{
|
|
"url": "https://r.sec-consult.com/imageaccess",
|
|
"refsource": "MISC",
|
|
"name": "https://r.sec-consult.com/imageaccess"
|
|
},
|
|
{
|
|
"url": "https://www.imageaccess.de/?page=SupportPortal&lang=en",
|
|
"refsource": "MISC",
|
|
"name": "https://www.imageaccess.de/?page=SupportPortal&lang=en"
|
|
}
|
|
]
|
|
},
|
|
"generator": {
|
|
"engine": "Vulnogram 0.2.0"
|
|
},
|
|
"source": {
|
|
"discovery": "UNKNOWN"
|
|
},
|
|
"exploit": [
|
|
{
|
|
"lang": "en",
|
|
"supportingMedia": [
|
|
{
|
|
"base64": false,
|
|
"type": "text/html",
|
|
"value": "The SEC Consult Vulnerability Lab has published proof of concept material in the technical security advisory.<br>"
|
|
}
|
|
],
|
|
"value": "The SEC Consult Vulnerability Lab has published proof of concept material in the technical security advisory."
|
|
}
|
|
],
|
|
"solution": [
|
|
{
|
|
"lang": "en",
|
|
"supportingMedia": [
|
|
{
|
|
"base64": false,
|
|
"type": "text/html",
|
|
"value": "The vendor provides a firmware update to version 7.40 (or higher) which can be downloaded via the vendor's customer server portal."
|
|
}
|
|
],
|
|
"value": "The vendor provides a firmware update to version 7.40 (or higher) which can be downloaded via the vendor's customer server portal."
|
|
}
|
|
],
|
|
"credits": [
|
|
{
|
|
"lang": "en",
|
|
"value": "Daniel Hirschberger (SEC Consult Vulnerability Lab)"
|
|
},
|
|
{
|
|
"lang": "en",
|
|
"value": "Tobias Niemann (SEC Consult Vulnerability Lab)"
|
|
}
|
|
]
|
|
} |