CVE-2024-10656 - Tongda OA 2017 apply.php sql injection

Back Back to CVE browser

MEDIUM

Tongda OA 2017 apply.php sql injection

Published Nov 1, 2024

5.3

MEDIUM

CVSS 4.0

EPSS 0.72%

Description

A vulnerability was found in Tongda OA 2017 up to 11.9. It has been rated as critical. This issue affects some unknown processing of the file /pda/meeting/apply.php. The manipulation of the argument mr_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

Affected products

Vendor Tongda Product n/a Default
n/a
- Version
  11.0
  Status
  affected
  Constraints
  -
- Version
  11.1
  Status
  affected
  Constraints
  -
- Version
  11.2
  Status
  affected
  Constraints
  -
- Version
  11.3
  Status
  affected
  Constraints
  -
- Version
  11.4
  Status
  affected
  Constraints
  -
- Version
  11.5
  Status
  affected
  Constraints
  -
- Version
  11.6
  Status
  affected
  Constraints
  -
- Version
  11.7
  Status
  affected
  Constraints
  -
- Version
  11.8
  Status
  affected
  Constraints
  -
- Version
  11.9
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Tongda

n/a

Version	Status	Constraints
11.0	affected	-
11.1	affected	-
11.2	affected	-
11.3	affected	-
11.4	affected	-
11.5	affected	-
11.6	affected	-
11.7	affected	-
11.8	affected	-
11.9	affected	-

Vendor Tongda Product n/a Default
n/a
- Version
  11.0
  Status
  affected
  Constraints
  -
- Version
  11.1
  Status
  affected
  Constraints
  -
- Version
  11.2
  Status
  affected
  Constraints
  -
- Version
  11.3
  Status
  affected
  Constraints
  -
- Version
  11.4
  Status
  affected
  Constraints
  -
- Version
  11.5
  Status
  affected
  Constraints
  -
- Version
  11.6
  Status
  affected
  Constraints
  -
- Version
  11.7
  Status
  affected
  Constraints
  -
- Version
  11.8
  Status
  affected
  Constraints
  -
- Version
  11.9
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Tongda

n/a

Version	Status	Constraints
11.0	affected	-
11.1	affected	-
11.2	affected	-
11.3	affected	-
11.4	affected	-
11.5	affected	-
11.6	affected	-
11.7	affected	-
11.8	affected	-
11.9	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-89

SQL Injection

References (5)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-33227
Advisory
https://github.com/LvZCh/td/issues/12
exploitissue-trackingThird Party Advisory
https://vuldb.com/?ctiid.282671
signaturepermissions-requiredPermissions RequiredVDB Entry
https://vuldb.com/?id.282671
vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry
https://vuldb.com/?submit.433517
third-party-advisoryThird Party AdvisoryVDB Entry

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-33227		Advisory
https://github.com/LvZCh/td/issues/12		exploitissue-trackingThird Party Advisory
https://vuldb.com/?ctiid.282671		signaturepermissions-requiredPermissions RequiredVDB Entry
https://vuldb.com/?id.282671		vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry
https://vuldb.com/?submit.433517		third-party-advisoryThird Party AdvisoryVDB Entry