SQL Injection Vulnerability in Tongda OA 2017 Products
CVE-2024-10600

9.8CRITICAL

Key Information:

Vendor

Tongda

Status
Oa 2017
Vendor
CVE Published:
31 October 2024

Badges

👾 Exploit Exists🟣 EPSS 40%

What is CVE-2024-10600?

A significant SQL injection vulnerability has been identified in the Tongda OA 2017 application, specifically within the file pda/appcenter/submenu.php. This vulnerability arises from improper handling of the 'appid' argument, allowing malicious actors to manipulate database queries. The flaw permits remote attackers to execute unauthorized SQL commands, posing a severe risk to data integrity and confidentiality. With the exploit now publicly disclosed, it is crucial for organizations using affected versions of Tongda OA 2017 to implement immediate security measures to mitigate potential attacks. Keeping your software up-to-date and following best practices in application security can help safeguard against these types of vulnerabilities.

Affected Version(s)

OA 2017 11.0

OA 2017 11.1

OA 2017 11.2

References

https://vuldb.com/?id.282612
vdb-entrytechnical-description
https://vuldb.com/?ctiid.282612
signaturepermissions-required
https://vuldb.com/?submit.433497
third-party-advisory

EPSS Score

40% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 👾

    Exploit known to exist

  • Vulnerability published

Credit

LVZC1 (VulDB User)
.