Tongda OA 2017 delete.php sql injection
CVE-2023-6608
7.5HIGH
Summary
A vulnerability exists in Tongda OA 2017 that allows an attacker to exploit the file general/notify/manage/delete.php. By manipulating the argument DELETE_STR, the attacker can perform SQL injection attacks, potentially leading to unauthorized data access or modification. Although the vendor was notified of this issue, they have not provided a response. Users are strongly advised to upgrade to version 11.10 or later to mitigate this security risk.
Affected Version(s)
OA 2017 11.0
OA 2017 11.1
OA 2017 11.2
References
CVSS V3.1
Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
willchen (VulDB User)