CVE-2024-2621 is a SQL injection in the Fujian Kelixin Communication Command and Dispatch Platform up to 20240318, in /api/client/user/pwd_update.php through the uuid argument. Severity is Medium at 6.3. No fixed version is named in the record, so check with the vendor.
What's affected
- Fujian Kelixin Communication Command and Dispatch Platform versions up to 20240318 are listed.
- The affected file is /api/client/user/pwd_update.php and the argument is uuid.
- The record says the exploit has been disclosed publicly and may be used. It does not report attacks, and the KEV flag is false.
- No fixed version is named in the NVD record. Check the vendor or the advisory linked in Sources before assuming a patch exists.
The NVD record gives a CVSS score of 6.3 with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. Published 2024-03-19.
How to check if you're exposed
- Find out whether the platform is deployed and which build date it reports.
- Search web server logs for requests to pwd_update.php; for example
grep -F "pwd_update.php" /var/log/nginx/access.log, adjusted to your server. - Review database logs for errors from malformed queries.
- See VulDB entry VDB-257198 named in the record.
What to do now
- Inventory the platform and note its version.
- Contact the vendor for a patch and apply it when one is confirmed.
- Limit access to the platform to trusted networks, since it is a command and dispatch system.
- Reduce the database account's privileges to what the application needs.
- Review logs for the affected path and rotate stored credentials if you see suspicious access.
If this software reaches you as part of something you build, the free in-browser dependency scan at gold.safeguard.sh/scan lists known vulnerabilities in your manifests, and reachability analysis helps you see which ones your code can actually trigger.
Why it matters
The cause is untrusted input reaching a database query without being kept separate. The score of 6.3 is medium because the vector shows low privileges required and limited impact in each of confidentiality, integrity and availability. For a dispatch platform, even limited database access matters, because the data may include operational details.
The record tags the weakness as CWE-89. See the Gold pages for more on the class.
SQL injection happens when input from a request is placed into a database query without being kept separate from the query itself. The database then treats part of the input as instructions. The usual defence is parameterised queries, plus a database account that can only do what the application needs.
The record's Known Exploited Vulnerabilities flag is false, so CISA has not listed it as exploited.
Three SQL injection flaws were published against this product in the same span: CVE-2024-2620, CVE-2024-2621 and CVE-2024-2622. When one endpoint has this weakness, others tend to as well.
Quick check
Are the three Kelixin flaws related?
They share the same product, build range and weakness class, and were published on the same days. Each affects a different file, so reviewing only one is not enough.
Sources
I did not retrieve the pages above when preparing this post, either because they blocked automated access or because I relied on the NVD record. The details here come from that record, so read the linked reference for the original wording.
Last reviewed: 19 October 2026.
