SQL Injection Vulnerability in Tongda OA 2017 Software

CVE-2024-10655

What is CVE-2024-10655?

A significant security flaw has been identified in Tongda OA 2017 software, specifically in the code handling the /pda/reportshop/new.php file. The vulnerability arises from improper validation of the 'repid' argument, enabling attackers to execute SQL injection attacks remotely. This issue presents a serious risk as it allows unauthorized users to manipulate database queries and potentially gain access to sensitive information. Consequently, this vulnerability has been publicly disclosed, heightening the urgency for organizations utilizing affected versions to implement necessary patches and protect their systems from exploitation.

References