PT-2024-37496 · Unknown · Pear Admin Boot

Rabbit · Published 2024-06-22 · Updated 2024-09-19 · CVE-2024-6266

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Pear Admin Boot versions up to 2.0.2

Description: A critical vulnerability has been found in Pear Admin Boot, affecting an unknown function of the file /system/dictData/loadDictItem. The manipulation leads to sql injection, and it is possible to launch the attack remotely.

Recommendations: For Pear Admin Boot versions up to 2.0.2, update to a version later than 2.0.2 to resolve the issue. As a temporary workaround, consider restricting access to the /system/dictData/loadDictItem file to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-6266

Affected Products

Pear Admin Boot

References · 9

• 🔥 https://gitee.com/pear-admin/Pear-Admin-Boot/issues/IA5K2M · Exploit
• https://osv.dev/vulnerability/CVE-2024-6266 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-6266 · Security Note
• https://vuldb.com/?id.269478 · Note
• https://twitter.com/linuxpatch/status/1804727482328776772 · Twitter Post
• https://twitter.com/CVEnew/status/1804706567037566999 · Twitter Post
• https://vuldb.com/?ctiid.269478 · Note
• https://t.me/cvenotify/95297 · Telegram Post
• https://t.me/cvenotify/84120 · Telegram Post