Tongda OA 2017 delete.php sql injection

CVE-2023-6608

What is CVE-2023-6608?

A vulnerability exists in Tongda OA 2017 that allows an attacker to exploit the file general/notify/manage/delete.php. By manipulating the argument DELETE_STR, the attacker can perform SQL injection attacks, potentially leading to unauthorized data access or modification. Although the vendor was notified of this issue, they have not provided a response. Users are strongly advised to upgrade to version 11.10 or later to mitigate this security risk.

References