Description
TurboMeeting是一款视频会议和远程支持服务器软件，提供高效的在线协作功能。TurboMeeting的/as/wapi/vmp接口存在布尔盲注SQL注入漏洞，攻击者可以通过该漏洞执行任意SQL命令，从而访问敏感数据或进一步危害服务器安全。
TurboMeeting /as/wapi/vmp SQL 注入漏洞（CVE-2024-38289）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2024-38289
https://github.com/google/security-research/security/advisories/GHSA-vx5j-8pgx-v42v
https://cn-sec.com/archives/3119906.html
https://www.gm7.org/archives/2687
https://www.sentinelone.com/vulnerability-database/cve-2024-38289/
https://pentest-tools.com/vulnerabilities-exploits/turbomeeting-boolean-based-sql-injection_22982
https://s4e.io/tools/turbomeeting-sql-injection-cve-2024-38289
https://vulmon.com/vulnerabilitydetails?qid=CVE-2024-38289
https://access.redhat.com/security/cve/cve-2024-38289