CVE-2024-38889

Critical · CVSS 9.8

Caterease — SQL Injection / Command Injection (CWE-89, CWE-78)

CVSS: 9.8; nvd
EPSS: 0.89%; 55th pct
KEV: No
Class: other; CWE-89, CWE-78

Description

An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a remote attacker to perform SQL Injection due to improper neutralization of special elements used in an SQL command.

Search profile — drives PoC discovery

Symbols CatereaseSQL InjectionCommand Injectionimproper neutralizationspecial elements

Keywords CVE-2024-38889Caterease SQL InjectionCaterease Command InjectionHorizon Business Services Caterease exploitCaterease 16.0.1.1663Caterease 24.0.1.2405Caterease PoCCaterease authentication bypasspacketstormsecurity Caterease

Versions: 16.0.1.1663 through 24.0.1.2405

Ranked PoCs (1) — best first

Heuristic ranking — not yet expert-vetted. Scored on structure + provenance, not execution.

fkie-cad/nvd-json-data-feeds needs review

trickest

★ 0

Recall-favoring discovery; ranking by the Stage-4 scorer (Adam's rubric). Scanner/aggregator repos are hidden.

References

Status: enriched · ingested 2026-07-05T06:00:39.000Z · profiled 2026-07-06T00:30:39.000Z