CVE-2024-3039

A vulnerability classified as critical has been found in Shanghai Brad Technology BladeX 3.4.0. Affected is an unknown function of the file /api/blade-user/export-user of the component API. The manipulation with the input updatexml(1,concat(0x3f,md5(123456),0x3f),1)=1 leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-258426 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

• CWE-89

• https://spoofer.cn/bladex_sqli/Third Party Advisory
• https://vuldb.com/?ctiid.258426Permissions Required
• https://vuldb.com/?id.258426Third Party Advisory
• https://vuldb.com/?submit.301469Third Party Advisory
• https://spoofer.cn/bladex_sqli/Third Party Advisory
• https://vuldb.com/?ctiid.258426Permissions Required
• https://vuldb.com/?id.258426Third Party Advisory
• https://vuldb.com/?submit.301469Third Party Advisory

Published

Mar 28, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-30382An Improper Handling of Exceptional Conditions vulnerability…8.7
• CVE-2024-30384An Improper Check for Unusual or Exceptional Conditions vuln…6.8
• CVE-2024-30386A Use-After-Free vulnerability in the Layer 2 Address Learni…7.1
• CVE-2024-30387A Missing Synchronization vulnerability in the Packet Forwar…7.1
• CVE-2024-30388An Improper Isolation or Compartmentalization vulnerability …7.1
• CVE-2024-30389An Incorrect Behavior Order vulnerability in the Packet Forw…6.9
• CVE-2024-30390An Improper Restriction of Excessive Authentication Attempts…6.9
• CVE-2024-30391A Missing Authentication for Critical Function vulnerability…6.3
• CVE-2024-30392A Stack-based Buffer Overflow vulnerability in Flow Processi…8.7
• CVE-2024-30394A Stack-based Buffer Overflow vulnerability in the Routing P…8.7
• CVE-2024-30395An Improper Validation of Specified Type of Input vulnerabil…8.7
• CVE-2024-30397An Improper Check for Unusual or Exceptional Conditions vuln…8.7