Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.9
CVE-2024-10600: Tongda OA 2017 allows SQL injection via malicious appid input
CVE-2024-10600 · published 2 years ago
Summary
A critical flaw in Tongda OA 2017's submenu feature allows an attacker to inject malicious SQL code. This could be used to access sensitive data or take control of the system. Upgrade to a fixed version of Tongda OA 2017 to protect against this attack.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| tongda2000 | office_anywhere |
>= 11.0, <= 11.6 2017 cpe:2.3:a:tongda2000:office_anywhere:*:*:*:*:*:*:*:* |
Original advisory text
A vulnerability, which was classified as critical, was found in Tongda OA 2017 up to 11.6. Affected is an unknown function of the file pda/appcenter/submenu.php. The manipulation of the argument ap...
A vulnerability, which was classified as critical, was found in Tongda OA 2017 up to 11.6. Affected is an unknown function of the file pda/appcenter/submenu.php. The manipulation of the argument appid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
References
- https://github.com/LvZCh/td/issues/3 Exploit Third Party Advisory
- https://vuldb.com/?ctiid.282612 Permissions Required VDB Entry
- https://vuldb.com/?id.282612 Third Party Advisory VDB Entry
- https://vuldb.com/?submit.433497 Third Party Advisory VDB Entry
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-89SQL Injection
Timeline
Published31 Oct 2024
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2024-10600 · NVD
Track software like this
Free during beta