Description
A vulnerability was found in Fujian Kelixin Communication Command and Dispatch Platform up to 20240318 and classified as critical. Affected by this issue is some unknown functionality of the file api/client/user/pwd_update.php. The manipulation of the argument uuid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-257198 is the identifier assigned to this vulnerability.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Fujian Kelixin Communication | Command and Dispatch Platform | 20240318 | — |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Fujian Kelixin Communication - Command Injection http/cves/2024/CVE-2024-2621.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
References
- VDB-257198 | Fujian Kelixin Communication Command and Dispatch Platform pwd_update.php sql injection vdb-entry technical-description
- VDB-257198 | CTI Indicators (IOB, IOC, TTP, IOA) signature permissions-required
- https://h0e4a0r1t.github.io/2024/vulns/Fujian%20Kelixin%20Communication%20Co.,%20Ltd.%20Command%20and%20Dispatch%20Platform%20SQL%20Injection%20Vulnerability-pwd_update.php.pdf exploit patch