SQL Injection Vulnerability in Tongda OA 2017 and Earlier Versions

CVE-2024-10656

Summary

A critical SQL injection vulnerability exists in the Tongda OA 2017 application, specifically in the processing of the file /pda/meeting/apply.php. The vulnerability arises due to improper validation of the 'mr_id' argument, allowing an attacker to manipulate SQL queries executed by the application. This flaw poses significant risks as it can be exploited remotely, potentially leading to unauthorized access to sensitive data or even complete control over the database environment. Once disclosed, this vulnerability was made public, raising concerns for users still operating on vulnerable versions. Organizations using Tongda OA 2017 or earlier should assess their systems for exposure to this flaw and implement necessary security measures to mitigate the risk.

References