CVE-2024-6003

MEDIUM Year: 2024
CVSS v3 Score
7.3
High
CVSS v2 Score
7.5
High
Weakness Type
CWE-89
View all →

Vulnerability Description

A vulnerability was found in Guangdong Baolun Electronics IP Network Broadcasting Service Platform 2.0. It has been classified as critical. Affected is an unknown function of the file /api/v2/maps. The manipulation of the argument orderColumn leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-268692. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Related Vulnerabilities

CVE-2015-8769

HIGH
CVSS:7.3(High)

SQL injection vulnerability in Joomla! 3.x before 3.4.7 allows attackers to execute arbitrary SQL commands via unspecified vectors.

CWE-892015

CVE-2016-10096

HIGH
CVSS:7.3(High)

SQL injection vulnerability in register.php in GeniXCMS before 1.0.0 allows remote attackers to execute arbitrary SQL commands via the activation parameter.

CWE-892016

CVE-2016-2299

HIGH
CVSS:7.3(High)

SQL injection vulnerability in Ecava IntegraXor before 5.0 build 4522 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

CWE-892016

CVE-2016-6453

HIGH
CVSS:7.3(High)

A vulnerability in the web framework code of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to execute arbitrary SQL commands on the database. More Information: CSC...

CWE-892016

CVE-2017-5151

HIGH
CVSS:7.3(High)

An issue was discovered in VideoInsight Web Client Version 6.3.5.11 and previous versions. A SQL Injection vulnerability has been identified, which may allow remote code execution.

CWE-892017

CVE-2019-15658

HIGH
CVSS:7.3(High)

connect-pg-simple before 6.0.1 allows SQL injection if tableName or schemaName is untrusted data.

CWE-892019