Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.3
CVE-2024-10618: Tongda OA 2017 SQL Injection Allows Remote Attack
CVE-2024-10618 · published 2 years ago
Summary
A critical flaw in Tongda OA 2017 allows hackers to inject malicious code into the software, potentially exposing sensitive data. This issue affects the reporting feature, which can be accessed remotely. To protect your data, update to a secure version of Tongda OA 2017 as soon as possible.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| tongda2000 | office_anywhere |
>= 11.0, <= 11.10 2017 cpe:2.3:a:tongda2000:office_anywhere:*:*:*:*:*:*:*:* |
Original advisory text
A vulnerability, which was classified as critical, has been found in Tongda OA 2017 up to 11.10. This issue affects some unknown processing of the file /pda/reportshop/record_detail.php. The manipu...
A vulnerability, which was classified as critical, has been found in Tongda OA 2017 up to 11.10. This issue affects some unknown processing of the file /pda/reportshop/record_detail.php. The manipulation of the argument repid leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
References
- https://github.com/LvZCh/td/issues/9 Exploit Third Party Advisory
- https://vuldb.com/?ctiid.282629 Permissions Required VDB Entry
- https://vuldb.com/?id.282629 Third Party Advisory VDB Entry
- https://vuldb.com/?submit.433513 Third Party Advisory VDB Entry
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-89SQL Injection
Timeline
Published1 Nov 2024
Updated4 Nov 2026
First seen7 Mar 2026
Track software like this
Free during beta