CVE-2024-22108

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An issue was discovered in GTB Central Console 15.17.1-30814.NG. The method setTermsHashAction at /opt/webapp/lib/PureApi/CCApi.class.php is vulnerable to an unauthenticated SQL injection via /ccapi.php that an attacker can abuse in order to change the Administrator password to a known value.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://adepts.of0x.cc/gtbcc-pwned/Exploit, Third Party Advisory
https://x-c3ll.github.io/cves.htmlExploit
https://adepts.of0x.cc/gtbcc-pwned/Exploit, Third Party Advisory
https://x-c3ll.github.io/cves.htmlExploit

Timeline

Published: Feb 2, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-22116.1Cross-Site Scripting stored vulnerability in Gophish affecting version 0.12.1. This vulnerability could allow an attacker to store a malicio CVE-2024-221136.1Open redirect vulnerability in Access analysis CGI An-Analyzer released in 2023 December 31 and earlier allows a remote unauthenticated atta CVE-2024-221144.3User with no permission to any of the Hosts can access and view host count & other statistics through System Information Widget in Global Vi CVE-2024-221167.2An administrator with restricted permissions can exploit the script execution functionality within the Monitoring Hosts section. The lack of CVE-2024-221172.2When a URL is added to the map element, it is recorded in the database with sequential IDs. Upon adding a new URL, the system retrieves the CVE-2024-221195.4The cause of vulnerability is improper validation of form input field “Name” on Graph page in Items section.CVE-2024-22127.8In Eclipse ThreadX before 6.4.0, xQueueCreate() and xQueueCreateSet() functions from the FreeRTOS compatibility API (utility/rtos_compati CVE-2024-221208.8Zabbix server can perform command execution for configured scripts. After command is executed, audit entry is added to "Audit Log". Due to "CVE-2024-221216.1A non-admin user can change or remove important features within the Zabbix Agent application, thus impacting the integrity and availability CVE-2024-221229.1Zabbix allows to configure SMS notifications. AT command injection occurs on "Zabbix Server" because there is no validation of "Number" fiel CVE-2024-221232.7Setting SMS media allows to set GSM modem file. Later this file is used as Linux device. But due everything is a file for Linux, it is possi CVE-2024-221247.5Under certain conditions, Internet Communication Manager (ICM) or SAP Web Dispatcher - versions KERNEL 7.22, KERNEL 7.53, KERNEL 7.54, KRNL6