Critical severity · published Jan 8, 2024
CVE-2024-0301
fhs-opensource iparking PayTempOrderAction.java getData sql injection
9.8
CVSS
0.7%
EPSS
No
On KEV
Description
A vulnerability classified as critical was found in fhs-opensource iparking 1.5.22.RELEASE. This vulnerability affects the function getData of the file src/main/java/com/xhb/pay/action/PayTempOrderAction.java. The manipulation leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249868.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 53% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IP
iparking · fhs-opensource
1.5.22.RELEASE · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-0301
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-0301
Exploit
https://github.com/laoquanshi/heishou/blob/main/iparking-SQL.pdf
Permissions Required
https://vuldb.com/?ctiid.249868
Third Party Advisory
https://vuldb.com/?id.249868
More from iparking
9.8
CVE-2024-0302
fhs-opensource iparking vueLogin deserialization