Tsinghua Unigroup Electronic Archives System Can Be Attacked Remotely

Summary

A weakness in the Tsinghua Unigroup Electronic Archives System could allow an attacker to execute malicious code remotely. This means that a hacker could potentially access sensitive information or disrupt the system. Update the software to the latest version to protect against this risk.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
unigroup	electronic_archives_system	<= 3.2.210802\(62532\)	–

Original title

A vulnerability has been found in Tsinghua Unigroup Electronic Archives System up to 3.2.210802(62532). Impacted is an unknown function of the file /mine/PublicReport/prinReport.html?token=java. Su...

Original description

A vulnerability has been found in Tsinghua Unigroup Electronic Archives System up to 3.2.210802(62532). Impacted is an unknown function of the file /mine/PublicReport/prinReport.html?token=java. Such manipulation of the argument comid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

nvd CVSS2.0 6.5

nvd CVSS3.1 9.8

nvd CVSS4.0 5.3

Vulnerability type

CWE-74 Injection

CWE-89 SQL Injection

https://github.com/luoye197-prog/cve-ziguang-sql/blob/main/introduce Broken Link
https://github.com/luoye197-prog/cve-ziguang-sql/blob/main/poc.py Broken Link
https://vuldb.com/?ctiid.346473 Permissions Required VDB Entry
https://vuldb.com/?id.346473 Third Party Advisory VDB Entry
https://vuldb.com/?submit.753308 Third Party Advisory VDB Entry