CVE-2024-6241

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in Pear Admin Boot up to 2.0.2 and classified as critical. This issue affects the function getDictItems of the file /system/dictData/getDictItems/. The manipulation with the input ,user(),1,1 leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-269375.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	Pear Admin Boot	2.0.0; 2.0.1; 2.0.2
pearadmin	pear_admin_boot	>= 2.0.0, <= 2.0.2

References

https://gitee.com/pear-admin/Pear-Admin-Boot/issues/IA5IPQExploit
https://gitee.com/pear-admin/Pear-Admin-Boot/issues/IA5KBSExploit
https://vuldb.com/?ctiid.269375Permissions Required
https://vuldb.com/?id.269375Third Party Advisory, VDB Entry
https://gitee.com/pear-admin/Pear-Admin-Boot/issues/IA5IPQExploit
https://gitee.com/pear-admin/Pear-Admin-Boot/issues/IA5KBSExploit
https://vuldb.com/?ctiid.269375Permissions Required
https://vuldb.com/?id.269375Third Party Advisory, VDB Entry

Timeline

Published: Jun 21, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-62427.3A vulnerability exists in Rockwell Automation affected products that allows a threat actor to bypass the Trusted® Slot feature in a ControlL CVE-2024-62434.8The HTML Forms WordPress plugin before 1.3.33 does not sanitize and escape the form message inputs, allowing high-privilege users, such as CVE-2024-62448.8The PZ Frontend Manager WordPress plugin before 1.0.6 does not have CSRF checks in some places, which could allow attackers to make logged i CVE-2024-62457.4Use of Default Credentials vulnerability in Maruti Suzuki SmartPlay on Linux (Infotainment Hub modules) allows attacker to try common or def CVE-2024-62468.8Wyze Cam v3 Realtek Wi-Fi Driver Heap-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent CVE-2024-62476.8Wyze Cam v3 Wi-Fi SSID OS Command Injection Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to e CVE-2024-62487.5Wyze Cam v3 Cloud Infrastructure Improper Authentication Remote Code Execution Vulnerability. This vulnerability allows network-adjacent att CVE-2024-62498.8Wyze Cam v3 TCP Traffic Handling Stack-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent CVE-2024-62507.5An absolute path traversal vulnerability exists in parisneo/lollms-webui v9.6, specifically in the `open_file` endpoint of `lollms_advanced.CVE-2024-62516.1A vulnerability, which was classified as problematic, was found in playSMS 1.4.3. Affected is an unknown function of the file /index.php?app CVE-2024-62526.1A vulnerability has been found in Zorlan SkyCaiji up to 2.8 and classified as problematic. Affected by this vulnerability is an unknown func CVE-2024-62539.8A vulnerability was found in itsourcecode Online Food Ordering System 1.0 and classified as critical. Affected by this issue is some unknown