A vulnerability was found in Pear Admin Boot up to 2.0.2 and classified as critical. This issue affects the function getDictItems of the file /system/dictData/getDictItems/. The manipulation with the input ,user(),1,1 leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-269375.
References
| Link | Resource |
|---|---|
| https://vuldb.com/?id.269375 | Third Party Advisory VDB Entry |
| https://vuldb.com/?ctiid.269375 | Permissions Required |
| https://gitee.com/pear-admin/Pear-Admin-Boot/issues/IA5IPQ | Exploit |
| https://gitee.com/pear-admin/Pear-Admin-Boot/issues/IA5KBS | Exploit |
Configurations
History
24 Jun 2024, 19:42
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Pearadmin pear Admin Boot
Pearadmin |
|
| References | () https://vuldb.com/?ctiid.269375 - Permissions Required | |
| References | () https://gitee.com/pear-admin/Pear-Admin-Boot/issues/IA5IPQ - Exploit | |
| References | () https://gitee.com/pear-admin/Pear-Admin-Boot/issues/IA5KBS - Exploit | |
| References | () https://vuldb.com/?id.269375 - Third Party Advisory, VDB Entry | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
| CPE | cpe:2.3:a:pearadmin:pear_admin_boot:*:*:*:*:*:*:*:* |
22 Jun 2024, 14:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
21 Jun 2024, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-06-21 17:15
Updated : 2024-06-24 19:42
NVD link : CVE-2024-6241
Mitre link : CVE-2024-6241
JSON object : View
Products Affected
pearadmin
- pear_admin_boot
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')