Analyzed
CVE has been recently published to the CVE List and has been received by the NVD.

Products

Hitout Carsale

carsale

Source

cna@vuldb.com

CVE-2024-6438 details

Published : July 2, 2024, 11:15 a.m.
Last Modified : July 2, 2024, 5:54 p.m.

Description

A vulnerability has been found in Hitout Carsale 1.0 and classified as critical. This vulnerability affects unknown code of the file OrderController.java. The manipulation of the argument orderBy leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-270166 is the identifier assigned to this vulnerability.

CVSS Score

1	2	3	4	5	6.5	7	8	9	10

Weakness

Weakness	Name	Description
CWE-89	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')	The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.

CVSS Data

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

Base Score

6.5

Exploitability Score

2.8

Impact Score

3.6

Base Severity

MEDIUM

Vector String : CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

URL	Source
https://github.com/Hitout/carsale/issues/23	cna@vuldb.com
https://vuldb.com/?ctiid.270166	cna@vuldb.com
https://vuldb.com/?id.270166	cna@vuldb.com
https://vuldb.com/?submit.366239	cna@vuldb.com

CPEs

Type	Vendor	Product	Version	Update	Edition	Language	Software Edition	Target Software	Target Hardware	Other Information
a	hitout	carsale	1.0	/	/	/	/	/	/	/

This website uses the NVD API, but is not approved or certified by it.

CVE-2024-6438