CVE-2023-6054: medium-severity vulnerability in Tongda OA 2017
Tongda OA 2017 lock.php sql injection
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
Tongda OA 2017 contains a SQL injection vulnerability in its lock.php file that allows attackers to manipulate database queries through the TERM_ID_STR parameter. This could let unauthorized users access, modify, or delete sensitive data from the application's database.
A SQL injection vulnerability exists in Tongda OA 2017 (up to version 11.9) in the general/wiki/cp/manage/lock.php file, where the TERM_ID_STR parameter is not properly sanitized before being used in SQL queries. An attacker with access to the affected parameter can inject malicious SQL code to execute arbitrary database operations. Upgrading to version 11.10 or later resolves this issue.
In the same product, most dangerous first.