CVE-2024-38885 – Caterease SQL Injection / Command Injection / Bypass

https://notcve.org/view.php?id=CVE-2024-38885

02 Aug 2024 — An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a remote attacker to perform unauthorized access using known operating system credentials due to hardcoded SQL user credentials in the client application. This is the official vulnerability disclosure report for CVEs CVE-2024-38881 through CVE-2024-38891 by jTag Labs. This report details critical security vulnerabilities found within Caterease, a product of Horizon Business Services Inc. ... • http://caterease.com • CWE-259: Use of Hard-coded Password •