CVE-2024-6438

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-6438

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-6438.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-6438

Published

2024-07-02T10:31:04.362Z

Modified

2026-07-15T01:49:19.986581074Z

Severity

5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N CVSS Calculator

Summary

Hitout Carsale OrderController.java sql injection

Details

A vulnerability has been found in Hitout Carsale 1.0 and classified as critical. This vulnerability affects unknown code of the file OrderController.java. The manipulation of the argument orderBy leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-270166 is the identifier assigned to this vulnerability.

Database specific

{
    "cna_assigner": "VulDB",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/6xxx/CVE-2024-6438.json",
    "cwe_ids": [
        "CWE-89"
    ]
}

References

Affected packages

Git / github.com/hitout/carsale

Affected ranges

Type

GIT

Repo

https://github.com/hitout/carsale

Events

Introduced

a77b1732eb39dd08e01b4921090767786e11ae36

Last affected

a77b1732eb39dd08e01b4921090767786e11ae36

Database specific

{
    "cpe": "cpe:2.3:a:hitout:carsale:1.0:*:*:*:*:*:*:*",
    "source": [
        "AFFECTED_FIELD",
        "CPE_STRING"
    ],
    "extracted_events": [
        {
            "introduced": "1.0"
        },
        {
            "last_affected": "1.0"
        }
    ]
}

Affected versions

1.*

1.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-6438.json"