CVE-2024-2566 is a high severity (CVSS 7.3) SQL injection in the Fujian Kelixin Communication Command and Dispatch Platform up to 20240313. The get_extension_yl.php API builds a query from the imei argument. The record names no fix, so contact the vendor.
What's affected
Fujian Kelixin Communication Command and Dispatch Platform up to 20240313, per the record. The affected file is api/client/get_extension_yl.php and the argument is imei. The record links a researcher write up and a VulDB entry.
The NVD record scores it 7.3 (high) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, published 2024-03-17. The weakness is classed as CWE-89 (SQL injection).
The record names no fixed version. Contact the vendor for a patched build and ask for the date of the fix.
How to check if you're exposed
Ask the vendor or your integrator for the build date of your deployment. Then search the web root for the file:
find /var/www -name 'get_extension_yl.php' 2>/dev/null
If it exists on a server that clients can reach, assume it is exposed.
What to do now
- Ask the vendor for the build date of your install and for a patched build.
- Restrict the API to the networks and devices that need it.
- Add a web application firewall rule or reverse proxy check on the imei parameter as a stopgap.
- Review database and web logs for odd requests to get_extension_yl.php.
- Plan a bound parameter fix if you maintain the code.
Why it matters
The weakness is SQL injection. Input from the request is placed into a database query without being separated from the query structure, so a crafted value can change what the query does. Depending on the table and the database account, that means reading rows the user was never meant to see, changing records, or in some setups going further.
The reliable fix is the same in every language: parameterised queries, a database account with only the rights the page needs, and server-side validation of types. Filtering bad characters by hand tends to fail. If you run the application and no patched release exists, treat its code as something you must change yourself or take off the network.
This CVE is not on the CISA Known Exploited Vulnerabilities list (the record's KEV flag is false). Exploit details are not repeated here, because this guide is about defence.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan lists the open source packages in a project and flags known vulnerabilities, and the Gold directory tracks this CVE. Reachability analysis helps decide which findings in your own code actually matter.
Quick check
What is the imei argument?
It is the device identifier sent to the API. The record says the value is used unsafely in a database query.
Sources
Last reviewed: 19 October 2026.
