← CVE Intelligence

CVE-2024-28145

Unauthenticated SQL Injection PUBLISHED

Description (CNA)

An unauthenticated attacker can perform an SQL injection by accessing the /class/dbconnect.php file and supplying malicious GET parameters. The HTTP GET parameters search, table, field, and value are vulnerable. For example, one SQL injection can be performed on the parameter "field" with the UNION keyword.

Affected (CNA)

Vendor / productVersions
Image Access GmbH / Scan2Netaffected 0 before 7.40

CWE

CWE-89

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.