{"id":"CVE-2024-6241","state":"PUBLISHED","title":"Pear Admin Boot getDictItems sql injection","description":"A vulnerability was found in Pear Admin Boot up to 2.0.2 and classified as critical. This issue affects the function getDictItems of the file /system/dictData/getDictItems/. The manipulation with the input ,user(),1,1 leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-269375.","publishedAt":"2024-06-21T17:00:15.647Z","updatedAt":"2024-08-01T21:33:05.100Z","severity":{"score":5.3,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","source":"VulDB"},"assigner":"VulDB","products":["n/a Pear Admin Boot"],"affected":[{"vendor":"n/a","product":"Pear Admin Boot","versions":[{"version":"2.0.0","status":"affected"},{"version":"2.0.1","status":"affected"},{"version":"2.0.2","status":"affected"}]}],"references":["https://vuldb.com/?id.269375","https://vuldb.com/?ctiid.269375","https://gitee.com/pear-admin/Pear-Admin-Boot/issues/IA5IPQ","https://gitee.com/pear-admin/Pear-Admin-Boot/issues/IA5KBS"],"weaknesses":["CWE-89"],"ingestedAt":"2026-10-29T20:08:12.933Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/6xxx/CVE-2024-6241.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-6241","state":"PUBLISHED","datePublished":"2024-06-21T17:00:15.647Z","dateUpdated":"2024-08-01T21:33:05.100Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2024-06-21T12:10:53.258Z"},"containers":{"cna":{"title":"Pear Admin Boot getDictItems sql injection","descriptions":[{"lang":"en","value":"A vulnerability was found in Pear Admin Boot up to 2.0.2 and classified as critical. This issue affects the function getDictItems of the file /system/dictData/getDictItems/. The manipulation with the input ,user(),1,1 leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-269375."},{"lang":"de","value":"Eine kritische Schwachstelle wurde in Pear Admin Boot bis 2.0.2 gefunden. Davon betroffen ist die Funktion getDictItems der Datei /system/dictData/getDictItems/. Durch das Manipulieren mit der Eingabe ,user(),1,1 mit unbekannten Daten kann eine sql injection-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk erfolgen. Der Exploit steht zur öffentlichen Verfügung."}],"affected":[{"vendor":"n/a","product":"Pear Admin Boot","versions":[{"version":"2.0.0","status":"affected"},{"version":"2.0.1","status":"affected"},{"version":"2.0.2","status":"affected"}]}],"references":[{"url":"https://vuldb.com/?id.269375","name":"VDB-269375 | Pear Admin Boot getDictItems sql injection","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.269375","name":"VDB-269375 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://gitee.com/pear-admin/Pear-Admin-Boot/issues/IA5IPQ","tags":["exploit","issue-tracking"]},{"url":"https://gitee.com/pear-admin/Pear-Admin-Boot/issues/IA5KBS","tags":["issue-tracking"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":6.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseSeverity":"MEDIUM"}},{"cvssV3_0":{"version":"3.0","baseScore":6.3,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseSeverity":"MEDIUM"}},{"cvssV2_0":{"version":"2.0","baseScore":6.5,"vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-89","type":"CWE","lang":"en","description":"CWE-89 SQL Injection"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2024-06-22T13:57:09.677Z"},"timeline":[{"time":"2024-06-21T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2024-06-21T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2024-06-22T16:01:51.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"VulDB Gitee Analyzer","type":"tool"}]},"adp":[{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"pearadmin","product":"pear_admin_boot","defaultStatus":"unknown","versions":[{"version":"2.0.0","status":"affected","lessThanOrEqual":"2.0.2","versionType":"custom"}],"cpes":["cpe:2.3:a:pearadmin:pear_admin_boot:2.0.0:*:*:*:*:*:*:*"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-06-27T14:51:52.109728Z","id":"CVE-2024-6241","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-06-28T18:32:24.368Z"}},{"title":"CVE Program Container","references":[{"url":"https://vuldb.com/?id.269375","name":"VDB-269375 | Pear Admin Boot getDictItems sql injection","tags":["vdb-entry","technical-description","x_transferred"]},{"url":"https://vuldb.com/?ctiid.269375","name":"VDB-269375 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required","x_transferred"]},{"url":"https://gitee.com/pear-admin/Pear-Admin-Boot/issues/IA5IPQ","tags":["exploit","issue-tracking","x_transferred"]},{"url":"https://gitee.com/pear-admin/Pear-Admin-Boot/issues/IA5KBS","tags":["issue-tracking","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-01T21:33:05.100Z"}}]}}}