SQL Injection Vulnerability in Tongda OA 2017 Affecting Record Processing

CVE-2024-10618

What is CVE-2024-10618?

A critical SQL injection vulnerability exists in the Tongda OA 2017 software, specifically affecting the processing of the /pda/reportshop/record_detail.php file. The vulnerability arises when the parameter 'repid' is manipulated, allowing attackers to execute arbitrary SQL commands remotely. This poses significant risks as it can lead to unauthorized access to sensitive data and possible system compromise. Public disclosure of this exploit has heightened the urgency for users to apply security measures promptly. It's crucial for organizations using affected versions to assess their exposure and implement necessary security patches to mitigate potential threats.

References