CVE-2024-9918

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

A vulnerability has been found in HuangDou UTCMS V9 and classified as critical. This vulnerability affects the function RunSql of the file app/modules/ut-data/admin/sql.php. The manipulation of the argument sql leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
HuangDou	UTCMS	V9
huangdou	utcms	v9

References

https://github.com/DeepMountains/zzz/blob/main/CVE5-3.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.280246Permissions Required, Third Party Advisory, VDB Entry
https://vuldb.com/?id.280246Third Party Advisory, VDB Entry
https://vuldb.com/?submit.418750Third Party Advisory, VDB Entry

Timeline

Published: Oct 13, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-99198.4A missing authentication check in the uninstall endpoint of parisneo/lollms-webui V13 allows attackers to perform unauthorized directory del CVE-2024-99208.8In version v12 of parisneo/lollms-webui, the 'Send file to AL' function allows uploading files with various extensions, including potentiall CVE-2024-99219.8The Team+ from TEAMPLUS TECHNOLOGY does not properly validate specific page parameter, allowing unauthenticated remote attackers to inject a CVE-2024-99227.5The Team+ from TEAMPLUS TECHNOLOGY does not properly validate a specific page parameter, allowing unauthenticated remote attackers to exploi CVE-2024-99234.9The Team+ from TEAMPLUS TECHNOLOGY does not properly validate a specific page parameter, allowing remote attackers with administrator privil CVE-2024-99249.8The fix for CVE-2024-26261 was incomplete, and and the specific package for OAKlouds from Hgiga remains at risk. Unauthenticated remote atta CVE-2024-99259.8SQL injection vulnerability in TAI Smart Factory's QPLANT SF version 1.0. Exploitation of this vulnerability could allow a remote attacker t CVE-2024-99264.3The Jetpack WordPress plugin does not have proper authorisation in one of its REST endpoint, allowing any authenticated users, such as subsc CVE-2024-99277.2The WooCommerce Order Proposal plugin for WordPress is vulnerable to privilege escalation via order proposal in all versions up to and inclu CVE-2024-99285.3A vulnerability exists in NSD570 login panel that does not restrict excessive authentication attempts. If exploited, this could cause accoun CVE-2024-99294.3A vulnerability exists in NSD570 that allows any authenticated user to access all device logs disclosing login information with timestamps.CVE-2024-99309.8The Extensions by HocWP Team plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 0.2.3.2. This is