CVE-2024-38289

2024-07-2500:00:00

mitre

www.cve.org

cve-2024-38289

sql injection

r-hub turbomeeting

vmp endpoint

remote attackers

hashed passwords

EPSS

0.009

Percentile

82.7%

JSON

A boolean-based SQL injection issue in the Virtual Meeting Password (VMP) endpoint in R-HUB TurboMeeting through 8.x allows unauthenticated remote attackers to extract hashed passwords from the database, and authenticate to the application, via crafted SQL input.