Lucene search

VulDBCVE-2023-7180

HistoryDec 30, 2023 - 6:15 p.m.

CVE-2023-7180

2023-12-3018:15:40

CWE-89

VulDB

web.nvd.nist.gov

cve-2023-7180

tongda oa

sql injection

vulnerability

upgrade

nvd

vdb-249367

CVSS2

5.2

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:A/AC:L/Au:S/C:P/I:P/A:P

CVSS3

5.5

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

AI Score

5.1

Confidence

High

EPSS

0.001

Percentile

19.7%

JSON

A vulnerability has been found in Tongda OA 2017 up to 11.9 and classified as critical. Affected by this vulnerability is an unknown functionality of the file general/project/proj/delete.php. The manipulation of the argument PROJ_ID_STR leads to sql injection. The exploit has been disclosed to the public and may be used. Upgrading to version 11.10 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-249367. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Affected configurations

Nvd

Vulners

Node

tongda2000office_anywhere_2017Range<11.10

VendorProductVersionCPE
tongda2000office_anywhere_2017*cpe:2.3:a:tongda2000:office_anywhere_2017:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
tongda2000	office_anywhere_2017	*	cpe:2.3:a:tongda2000:office_anywhere_2017::::::::

CNA Affected

[
  {
    "vendor": "Tongda",
    "product": "OA 2017",
    "versions": [
      {
        "version": "11.0",
        "status": "affected"
      },
      {
        "version": "11.1",
        "status": "affected"
      },
      {
        "version": "11.2",
        "status": "affected"
      },
      {
        "version": "11.3",
        "status": "affected"
      },
      {
        "version": "11.4",
        "status": "affected"
      },
      {
        "version": "11.5",
        "status": "affected"
      },
      {
        "version": "11.6",
        "status": "affected"
      },
      {
        "version": "11.7",
        "status": "affected"
      },
      {
        "version": "11.8",
        "status": "affected"
      },
      {
        "version": "11.9",
        "status": "affected"
      }
    ]
  }
]

References

github.com/Bobjones7/cve/blob/main/sql.md

vuldb.com/?ctiid.249367

vuldb.com/?id.249367

CVSS2

5.2

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:A/AC:L/Au:S/C:P/I:P/A:P

CVSS3

5.5

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

AI Score

5.1

Confidence

High

EPSS

0.001

Percentile

19.7%

JSON

Related for CVE-2023-7180