CVE-2024-38289

2024-07-2500:00:00

mitre

github.com

cve-2024-38289

virtual meeting password

r-hub turbomeeting

sql injection

unauthenticated remote attackers

hashed passwords

application authentication

AI Score

8.1

Confidence

Low

EPSS

0.009

Percentile

82.7%

SSVC

Exploitation

poc

Automatable

Technical Impact

partial

JSON

A boolean-based SQL injection issue in the Virtual Meeting Password (VMP) endpoint in R-HUB TurboMeeting through 8.x allows unauthenticated remote attackers to extract hashed passwords from the database, and authenticate to the application, via crafted SQL input.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:r-hub:turbomeeting:*:*:*:*:*:*:*:*"
    ],
    "vendor": "r-hub",
    "product": "turbomeeting",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "8.x",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  }
]