SQL Injection Vulnerability in Tongda OA 2017 Products
CVE-2024-10600

9.8CRITICAL

Key Information:

Vendor
Tongda
Status
Oa 2017
Vendor
CVE Published:
31 October 2024

Badges

👾 Exploit Exists🟡 Public PoC🟣 EPSS 40%

Summary

A significant SQL injection vulnerability has been identified in the Tongda OA 2017 application, specifically within the file pda/appcenter/submenu.php. This vulnerability arises from improper handling of the 'appid' argument, allowing malicious actors to manipulate database queries. The flaw permits remote attackers to execute unauthorized SQL commands, posing a severe risk to data integrity and confidentiality. With the exploit now publicly disclosed, it is crucial for organizations using affected versions of Tongda OA 2017 to implement immediate security measures to mitigate potential attacks. Keeping your software up-to-date and following best practices in application security can help safeguard against these types of vulnerabilities.

Affected Version(s)

OA 2017 11.0

OA 2017 11.1

OA 2017 11.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2024-10600 - Proof of Concept

References

https://vuldb.com/?id.282612
vdb-entrytechnical-description
https://vuldb.com/?ctiid.282612
signaturepermissions-required
https://vuldb.com/?submit.433497
third-party-advisory

EPSS Score

40% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

Credit

LVZC1 (VulDB User)
.
CVE-2024-10600 : SQL Injection Vulnerability in Tongda OA 2017 Products | SecurityVulnerability.io