CVE-2024-0301

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability classified as critical was found in fhs-opensource iparking 1.5.22.RELEASE. This vulnerability affects the function getData of the file src/main/java/com/xhb/pay/action/PayTempOrderAction.java. The manipulation leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249868.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
fhs-opensource	iparking	1.5.22.RELEASE

References

https://github.com/laoquanshi/heishou/blob/main/iparking-SQL.pdfExploit, Third Party Advisory
https://vuldb.com/?ctiid.249868Permissions Required, Third Party Advisory
https://vuldb.com/?id.249868Third Party Advisory
https://github.com/laoquanshi/heishou/blob/main/iparking-SQL.pdfExploit, Third Party Advisory
https://vuldb.com/?ctiid.249868Permissions Required, Third Party Advisory
https://vuldb.com/?id.249868Third Party Advisory

Timeline

Published: Jan 8, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-03029.8A vulnerability, which was classified as critical, has been found in fhs-opensource iparking 1.5.22.RELEASE. This issue affects some unknown CVE-2024-03039.8A vulnerability, which was classified as critical, was found in Youke365 up to 1.5.3. Affected is an unknown function of the file /app/api/c CVE-2024-03049.8A vulnerability has been found in Youke365 up to 1.5.3 and classified as critical. Affected by this vulnerability is an unknown functionalit CVE-2024-03057.5A vulnerability was found in Guangzhou Yingke Electronic Technology Ncast up to 2017 and classified as problematic. Affected by this issue i CVE-2024-03067.5A vulnerability was found in Kashipara Dynamic Lab Management System up to 1.0. It has been classified as critical. This affects an unknown CVE-2024-03077.5A vulnerability was found in Kashipara Dynamic Lab Management System up to 1.0. It has been declared as critical. This vulnerability affects CVE-2024-03088.8A vulnerability was found in Inis up to 2.0.1. It has been rated as critical. This issue affects some unknown processing of the file app/api CVE-2024-03106.1A content-security-policy vulnerability in ENS Control browser extension prior to 10.7.0 Update 15 allows a remote attacker to alter the res CVE-2024-03115.5A malicious insider can bypass the existing policy of Skyhigh Client Proxy without a valid release code.CVE-2024-03125.5A malicious insider can uninstall Skyhigh Client Proxy without a valid uninstall password.CVE-2024-03135.5A malicious insider exploiting this vulnerability can circumvent existing security controls put in place by the organization. On the contrar CVE-2024-03146.1XSS vulnerability in FireEye Central Management affecting version 9.1.1.956704, which could allow an attacker to modify special HTML element