h0e4a0r1t.github.ioexploitpatch
https://h0e4a0r1t.github.io/2024/vulns/Fujian%20Kelixin%20Communication%20Co.,%20Ltd.%20Command%20and%20Dispatch%20Platform%20SQL%20Injection%20Vulnerability-pwd_update.php.pdf CVE-2024-2621
MEDIUMNuclei
Fujian Kelixin Communication Command and Dispatch Platform pwd_update.php sql injection
Record summary
CVE-2024-2621 has a selected CVSS score of 6.3 (medium); EIP currently links 1 Nuclei template.
Description
A vulnerability was found in Fujian Kelixin Communication Command and Dispatch Platform up to 20240318 and classified as critical. Affected by this issue is some unknown functionality of the file api/client/user/pwd_update.php. The manipulation of the argument uuid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-257198 is the identifier assigned to this vulnerability.
Description source: CVE List
Exploitation context
Available material
- Nuclei templates
- 1
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Mar 19, 2024 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
Command and Dispatch PlatformBrowse Fujian Kelixin Communication / Command and Dispatch Platform | CVE List | 20240318 | affected |
Nuclei templates
1ProjectDiscoveryMEDIUMFujian Kelixin Communication - Command InjectionCVSS 6.3
A vulnerability was found in Fujian Kelixin Communication Command and Dispatch Platform up to 20240318 and classified as critical. Affected by this issue is some unknown functionality of the file api/client/user/pwd_update.php.
Impact
Authenticated attackers can extract sensitive database information via time-based SQL injection in the usr_number parameter.
Remediation
Update Fujian Kelixin Communication Command and Dispatch Platform to a version newer than 20240318.
WeaknessesCWE-89
AuthorsDhiyaneshDk
Template tagstime-based-sqlicvecve2024sqlifujianrcevuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
FOFA: body="app/structure/departments.php" || app="指挥调度管理平台"
https://h0e4a0r1t.github.io/2024/vulns/Fujian%20Kelixin%20Communication%20Co.,%20Ltd.%20Command%20and%20Dispatch%20Platform%20SQL%20Injection%20Vulnerability-pwd_update.php.pdf https://vuldb.com/?ctiid.257198 https://vuldb.com/?id.257198 https://github.com/NaInSec/CVE-LIST https://github.com/fkie-cad/nvd-json-data-feeds https://nvd.nist.gov/vuln/detail/CVE-2024-2621
Source: ProjectDiscovery
References
4nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2024-2621 VDB-257198 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions required
https://vuldb.com/?ctiid.257198 VDB-257198 | Fujian Kelixin Communication Command and Dispatch Platform pwd_update.php sql injectionvdb entryTechnical description
https://vuldb.com/?id.257198