CVE-2024-11305 Scanner
CVE-2024-11305 Scanner - SQL Injection vulnerability in Altenergy Power Control Software
Short Info
Level
Medium
Single Scan
Single Scan
Can be used by
Asset Owner
Estimated Time
10 seconds
Time Interval
26 days 12 hours
Scan only one
Domain, IPv4
Toolbox
-
The Altenergy Power Control Software is designed to manage and monitor energy systems in residential and commercial environments. It is primarily used by energy solution providers and system integrators for its ability to optimize power distribution and monitor performance remotely. Its applications span across diverse industries, including renewable energy management and building automation.
This scanner detects a SQL Injection vulnerability in the Altenergy Power Control Software. This vulnerability stems from insufficient input validation in the `date` parameter of the `get_status_zigbee` function in `/index.php/display/status_zigbee`. Exploiting this issue allows attackers to manipulate SQL queries by injecting crafted payloads.
The vulnerability resides in the lack of sanitization and validation for the `date` parameter. An attacker can submit malicious SQL commands that execute arbitrary database queries, leading to potential data leakage or alteration. The vulnerable endpoint `/index.php/display/status_zigbee` is exposed to remote exploitation without requiring local access or elevated privileges.
If successfully exploited, this vulnerability could allow attackers to compromise sensitive data, modify records, or disrupt system operations. It may also pave the way for further attacks against the affected system, causing significant security and operational risks for users of the software.
REFERENCES