{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2024-28145",
        "assignerOrgId": "551230f0-3615-47bd-b7cc-93e92e730bbf",
        "state": "PUBLISHED",
        "assignerShortName": "SEC-VLab",
        "dateReserved": "2024-03-05T09:15:40.202Z",
        "datePublished": "2024-12-12T13:36:34.917Z",
        "dateUpdated": "2025-11-03T21:54:31.104Z"
    },
    "containers": {
        "cna": {
            "affected": [
                {
                    "defaultStatus": "affected",
                    "product": "Scan2Net",
                    "vendor": "Image Access GmbH",
                    "versions": [
                        {
                            "changes": [
                                {
                                    "at": "7.40",
                                    "status": "unaffected"
                                }
                            ],
                            "lessThan": "7.40",
                            "status": "affected",
                            "version": "0",
                            "versionType": "custom"
                        }
                    ]
                }
            ],
            "credits": [
                {
                    "lang": "en",
                    "type": "finder",
                    "value": "Daniel Hirschberger (SEC Consult Vulnerability Lab)"
                },
                {
                    "lang": "en",
                    "type": "finder",
                    "value": "Tobias Niemann (SEC Consult Vulnerability Lab)"
                }
            ],
            "descriptions": [
                {
                    "lang": "en",
                    "supportingMedia": [
                        {
                            "base64": false,
                            "type": "text/html",
                            "value": "<p></p><p></p><div><p></p><div><div><div><div><p>An unauthenticated attacker can perform an SQL injection by accessing the <span style=\"background-color: rgb(253, 253, 253);\">/class/dbconnect.php&nbsp;</span>file and supplying malicious GET parameters. T<span style=\"background-color: rgb(255, 255, 255);\">he HTTP GET parameters search, table, field, and value are vulnerable. For example, one SQL injection can be performed on the parameter \"field\" with the UNION keyword.</span></p></div></div></div></div><div></div><p></p></div><p></p><p></p>"
                        }
                    ],
                    "value": "An unauthenticated attacker can perform an SQL injection by accessing the /class/dbconnect.php file and supplying malicious GET parameters. The HTTP GET parameters search, table, field, and value are vulnerable. For example, one SQL injection can be performed on the parameter \"field\" with the UNION keyword."
                }
            ],
            "exploits": [
                {
                    "lang": "en",
                    "supportingMedia": [
                        {
                            "base64": false,
                            "type": "text/html",
                            "value": "The SEC Consult Vulnerability Lab has published proof of concept material in the technical security advisory.<br>"
                        }
                    ],
                    "value": "The SEC Consult Vulnerability Lab has published proof of concept material in the technical security advisory."
                }
            ],
            "impacts": [
                {
                    "capecId": "CAPEC-66",
                    "descriptions": [
                        {
                            "lang": "en",
                            "value": "CAPEC-66 SQL Injection"
                        }
                    ]
                }
            ],
            "problemTypes": [
                {
                    "descriptions": [
                        {
                            "cweId": "CWE-89",
                            "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
                            "lang": "en",
                            "type": "CWE"
                        }
                    ]
                }
            ],
            "providerMetadata": {
                "orgId": "551230f0-3615-47bd-b7cc-93e92e730bbf",
                "shortName": "SEC-VLab",
                "dateUpdated": "2024-12-12T13:36:34.917Z"
            },
            "references": [
                {
                    "tags": [
                        "third-party-advisory"
                    ],
                    "url": "https://r.sec-consult.com/imageaccess"
                },
                {
                    "tags": [
                        "patch"
                    ],
                    "url": "https://www.imageaccess.de/?page=SupportPortal&lang=en"
                }
            ],
            "solutions": [
                {
                    "lang": "en",
                    "supportingMedia": [
                        {
                            "base64": false,
                            "type": "text/html",
                            "value": "The vendor provides a firmware update to version 7.40 (or higher) which can be downloaded via the vendor's customer server portal."
                        }
                    ],
                    "value": "The vendor provides a firmware update to version 7.40 (or higher) which can be downloaded via the vendor's customer server portal."
                }
            ],
            "source": {
                "discovery": "UNKNOWN"
            },
            "title": "Unauthenticated SQL Injection",
            "x_generator": {
                "engine": "Vulnogram 0.2.0"
            }
        },
        "adp": [
            {
                "metrics": [
                    {
                        "cvssV3_1": {
                            "scope": "UNCHANGED",
                            "version": "3.1",
                            "baseScore": 5.9,
                            "attackVector": "LOCAL",
                            "baseSeverity": "MEDIUM",
                            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
                            "integrityImpact": "LOW",
                            "userInteraction": "NONE",
                            "attackComplexity": "LOW",
                            "availabilityImpact": "LOW",
                            "privilegesRequired": "NONE",
                            "confidentialityImpact": "LOW"
                        }
                    },
                    {
                        "other": {
                            "type": "ssvc",
                            "content": {
                                "timestamp": "2024-12-13T16:16:12.359376Z",
                                "id": "CVE-2024-28145",
                                "options": [
                                    {
                                        "Exploitation": "none"
                                    },
                                    {
                                        "Automatable": "no"
                                    },
                                    {
                                        "Technical Impact": "partial"
                                    }
                                ],
                                "role": "CISA Coordinator",
                                "version": "2.0.3"
                            }
                        }
                    }
                ],
                "title": "CISA ADP Vulnrichment",
                "providerMetadata": {
                    "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
                    "shortName": "CISA-ADP",
                    "dateUpdated": "2024-12-13T16:18:02.936Z"
                }
            },
            {
                "title": "CVE Program Container",
                "references": [
                    {
                        "url": "http://seclists.org/fulldisclosure/2024/Dec/2"
                    }
                ],
                "providerMetadata": {
                    "orgId": "af854a3a-2127-422b-91ae-364da2661108",
                    "shortName": "CVE",
                    "dateUpdated": "2025-11-03T21:54:31.104Z"
                }
            }
        ]
    }
}