CVE-2024-28145

{"id": "CVE-2024-28145", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 2.5}]}, "published": "2024-12-12T14:15:22.467", "references": [{"url": "https://r.sec-consult.com/imageaccess", "source": "551230f0-3615-47bd-b7cc-93e92e730bbf"}, {"url": "https://www.imageaccess.de/?page=SupportPortal&lang=en", "source": "551230f0-3615-47bd-b7cc-93e92e730bbf"}, {"url": "http://seclists.org/fulldisclosure/2024/Dec/2", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "551230f0-3615-47bd-b7cc-93e92e730bbf", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "An unauthenticated attacker can perform an SQL injection by accessing the /class/dbconnect.php\u00a0file and supplying malicious GET parameters. The HTTP GET parameters search, table, field, and value are vulnerable. For example, one SQL injection can be performed on the parameter \"field\" with the UNION keyword."}, {"lang": "es", "value": "Un atacante no autenticado puede realizar una inyecci\u00f3n SQL accediendo al archivo /class/dbconnect.php y suministrando par\u00e1metros GET maliciosos. Los par\u00e1metros HTTP GET search, table, field y value son vulnerables. Por ejemplo, se puede realizar una inyecci\u00f3n SQL en el par\u00e1metro \"field\" con la palabra clave UNION."}], "lastModified": "2025-11-03T22:16:50.503", "sourceIdentifier": "551230f0-3615-47bd-b7cc-93e92e730bbf"}