CVE-2024-28145

🗓️ 12 Dec 2024 13:36:34Reported by SEC-VLabType

cve🔗 web.nvd.nist.gov👁 53 Views🌐 WEB

Unauthenticated SQL injection vulnerability via GET parameters in dbconnect.php file.

Reporter	Title	Published	Views	Family All 6
Circl	CVE-2024-28145	12 Dec 202413:43	–	circl
CNNVD	Image Access Scan2Net 安全漏洞	12 Dec 202400:00	–	cnnvd
Cvelist	CVE-2024-28145 Unauthenticated SQL Injection	12 Dec 202413:36	–	cvelist
NVD	CVE-2024-28145	12 Dec 202414:15	–	nvd
RedhatCVE	CVE-2024-28145	23 May 202507:45	–	redhatcve
Vulnrichment	CVE-2024-28145 Unauthenticated SQL Injection	12 Dec 202413:36	–	vulnrichment

[
  {
    "defaultStatus": "affected",
    "product": "Scan2Net",
    "vendor": "Image Access GmbH",
    "versions": [
      {
        "changes": [
          {
            "at": "7.40",
            "status": "unaffected"
          }
        ],
        "lessThan": "7.40",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
r	www.r.sec-consult.com/imageaccess
imageaccess	www.imageaccess.de/
seclists	www.seclists.org/fulldisclosure/2024/Dec/2

Parameter	Position	Path	Description	CWE
search	query param	/class/dbconnect.php	SQL injection via unauthenticated access to /class/dbconnect.php using vulnerable GET parameters (search, table, field, value).	CWE-89
table	query param	/class/dbconnect.php	SQL injection via unauthenticated access to /class/dbconnect.php using vulnerable GET parameters (search, table, field, value).	CWE-89
field	query param	/class/dbconnect.php	SQL injection via unauthenticated access to /class/dbconnect.php using vulnerable GET parameters (search, table, field, value).	CWE-89
value	query param	/class/dbconnect.php	SQL injection via unauthenticated access to /class/dbconnect.php using vulnerable GET parameters (search, table, field, value).	CWE-89

17 Jun 2026 07:21Current

7.7High risk

Vulners AI Score7.7

CVSS 3.15.9

EPSS0.00517

SSVC

CWE-89