Description
A vulnerability classified as critical was found in Altenergy Power Control Software up to 20241108. This vulnerability affects the function get_status_zigbee of the file /index.php/display/status_zigbee. The manipulation of the argument date leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Altenergy | Power Control Software | 20241108 | — |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Altenergy Power Control Software - SQL Injection http/cves/2024/CVE-2024-11305.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
References
- VDB-284914 | Altenergy Power Control Software status_zigbee get_status_zigbee sql injection vdb-entry technical-description
- VDB-284914 | CTI Indicators (IOB, IOC, TTP, IOA) signature permissions-required
- Submit #439800 | Altenergy Altenergy Power Control Software Altenergy Power Control Software SQL Injection third-party-advisory
- https://github.com/h0e4a0r1t/h0e4a0r1t.github.io/blob/master/2024/HYO%3BY)v%3B4%5C)jLCjp/Altenergy%20has%20a%20SQL%20injection%20vulnerability_status_zigbee.pdf exploit