PT-2023-5589 · Tongda · Tongda Oa 2017

Haolunsong · Published 2023-09-29 · Updated 2024-05-17 · CVE-2023-5261

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Tongda OA 2017 versions prior to 11.10

Description A critical issue was found in Tongda OA 2017, affecting an unknown function of the file general/hr/manage/staff title evaluation/delete.php. The manipulation of the EVALUATION ID argument leads to SQL injection. This issue may allow a remote attacker to impact the confidentiality, integrity, and availability of protected information.

Recommendations For Tongda OA 2017 versions prior to 11.10, upgrade to version 11.10 to address this issue. As a temporary workaround, consider restricting access to the delete.php file in the general/hr/manage/staff title evaluation directory to minimize the risk of exploitation. Avoid using the EVALUATION ID parameter in the affected file until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2023-06243

CVE-2023-5261

Affected Products

Tongda Oa 2017

References · 11

• 🔥 https://github.com/csbsong/bug_report/blob/main/sql2.md · Exploit
• https://bdu.fstec.ru/vul/2023-06243 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-5261 · Security Note
• https://osv.dev/vulnerability/CVE-2023-5261 · Vendor Advisory
• https://twitter.com/CVEnew/status/1707734112591634864 · Twitter Post
• https://t.me/cibsecurity/71288 · Telegram Post
• https://vuldb.com/?ctiid.240870 · Note
• https://tongda2000.com/oa/MYOA2022 · Note
• https://tongda2000.com · Note
• https://twitter.com/VulmonFeeds/status/1707770745084883119 · Twitter Post
• https://vuldb.com/?id.240870 · Note