CVE-2024-28145

An unauthenticated attacker can perform an SQL injection by accessing the /class/dbconnect.php file and supplying malicious GET parameters. The HTTP GET parameters search, table, field, and value are vulnerable. For example, one SQL injection can be performed on the parameter "field" with the UNION keyword.

• CWE-89

• https://r.sec-consult.com/imageaccess
• https://www.imageaccess.de/?page=SupportPortal&lang=en
• http://seclists.org/fulldisclosure/2024/Dec/2

Published

Dec 12, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-2814A vulnerability was found in Tenda AC15 15.03.20_multi. It h…9.8
• CVE-2024-28140The scanner device boots into a kiosk mode by default and op…6.1
• CVE-2024-28141The web application is not protected against cross-site requ…6.3
• CVE-2024-28142Due to missing input sanitization, an attacker can perform c…4.7
• CVE-2024-28143The password change function at /cgi/admin.cgi does not requ…8.4
• CVE-2024-28144An attacker who can spoof the IP address and the User-Agent …5.5
• CVE-2024-28146The application uses several hard-coded credentials to encry…8.4
• CVE-2024-28147An authenticated user can upload arbitrary files in the uplo…7.4
• CVE-2024-28148An authenticated user could potentially access metadata for …4.3
• CVE-2024-28149Jenkins HTML Publisher Plugin 1.16 through 1.32 (both inclus…6.5
• CVE-2024-2815A vulnerability classified as critical has been found in Ten…9.8
• CVE-2024-28150Jenkins HTML Publisher Plugin 1.32 and earlier does not esca…4.7