Unauthorized SQL Injection Vulnerability in The Team+
CVE-2024-9921

9.8CRITICAL

Key Information:

Vendor

TEAMPLUS TECHNOLOGY

Status
Team\+ Pro
Vendor
CVE Published:
14 October 2024

What is CVE-2024-9921?

The Team+ application from TEAMPLUS TECHNOLOGY exposes a security flaw that allows unauthenticated remote attackers to inject arbitrary SQL commands through unvalidated page parameters. This vulnerability enables the attackers to read, modify, or delete critical database contents without the required authentication, putting sensitive data at risk. Remedying this issue involves implementing strict input validation and employing secure coding practices to safeguard against SQL injection attacks.

References

https://www.twcert.org.tw/tw/cp-132-8124-d9b92-1.html
https://www.twcert.org.tw/en/cp-139-8125-4a1ad-2.html

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.