CVE Wiki Pixee · CVE intelligence
← All CVEs

CVE-2024-38887

Critical · CVSS 9.8

Caterease — OS Command Injection via excessive database privileges (CWE-78)

CVSS
9.8
nvd
EPSS
1.68%
74th pct
KEV
No
Class
other
CWE-78, CWE-78

Description

An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a remote attacker to expand control over the operating system from the database due to the execution of commands with unnecessary privileges.

Search profile — drives PoC discovery

Symbols xp_cmdshellSQL InjectionCommand Injectiondatabase privilegesos command executionCatereaseMSSQL
Keywords CVE-2024-38887Catereasecommand injectionSQL injectionOS command injectiondatabase privilege escalationHorizon Business ServicesCaterease 16.0.1Caterease 24.0.1packetstorm 179892
Versions: 16.0.1.1663 through 24.0.1.2405

Ranked PoCs (29) — best first

Heuristic ranking — not yet expert-vetted. Scored on structure + provenance, not execution.

Recall-favoring discovery; ranking by the Stage-4 scorer (Adam's rubric). Scanner/aggregator repos are hidden.

References

Status: enriched · ingested 2026-07-05T06:00:39.000Z · profiled 2026-07-06T00:30:39.000Z