CVE-2024-38289

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A boolean-based SQL injection issue in the Virtual Meeting Password (VMP) endpoint in R-HUB TurboMeeting through 8.x allows unauthenticated remote attackers to extract hashed passwords from the database, and authenticate to the application, via crafted SQL input.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a
r-hub	turbomeeting	< 8.x

References

https://github.com/google/security-research/security/advisories/GHSA-vx5j-8pgx-v42vExploit, Third Party Advisory
https://www.rhubcom.com/v5/manuals.htmlProduct
https://github.com/google/security-research/security/advisories/GHSA-vx5j-8pgx-v42vExploit, Third Party Advisory
https://www.rhubcom.com/v5/manuals.htmlProduct

Timeline

Published: Jul 25, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-38299.1qdrant/qdrant version 1.9.0-dev is vulnerable to arbitrary file read and write during the snapshot recovery process. Attackers can exploit t CVE-2024-382905.3In XIQ-SE before 24.2.11, a server misconfiguration may allow user enumeration when specific conditions are met.CVE-2024-382918.8In XIQ-SE before 24.2.11, a low-privileged user may be able to access admin passwords, which could lead to privilege escalation.CVE-2024-382929.8In Extreme Networks XIQ-SE before 24.2.11, due to a missing access control check, a path traversal is possible, which may lead to privilege CVE-2024-382939.6ALCASAR before 3.6.1 allows CSRF and remote code execution in activity.php.CVE-2024-382949.8ALCASAR before 3.6.1 allows email_registration_back.php remote code execution.CVE-2024-382959.8ALCASAR before 3.6.1 allows still_connected.php remote code execution.CVE-2024-382964.4Dell Edge Gateway 3200, versions prior to 15.40.30.2879, and Edge Gateway 5200, versions prior to 12.0.94.2380, contain an Exposure of Sensi CVE-2024-383017.8Dell Alienware Command Center, version 5.7.3.0 and prior, contains an improper access control vulnerability. A low privileged attacker could CVE-2024-383025.7Dell Data Lakehouse, version(s) 1.0.0.0, contain(s) a Missing Encryption of Sensitive Data vulnerability in the DDAE (Starburst). A low priv CVE-2024-383036.0Dell PowerEdge Platform, 14G Intel BIOS version(s) prior to 2.22.x, contains an Improper Input Validation vulnerability. A high privileged a CVE-2024-383046.5Dell PowerEdge Platform, 14G Intel BIOS version(s) prior to 2.22.x, contains an Access of Memory Location After End of Buffer vulnerability.