PT-2025-5990 · Tally · Tally Prime Edit Log

Manpreet Singh Kheberi · CVE-2024-48091 · Published 2025-02-07 · Updated 2025-02-07

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Tally Prime Edit Log version 2.1

Description A DLL hijacking issue was discovered in the TextShaping.dll component, allowing attackers to execute arbitrary code through a manipulated DLL. This issue enables the execution of arbitrary code via a crafted DLL.

Recommendations For Tally Prime Edit Log version 2.1, consider disabling the use of the TextShaping.dll component until a patch is available to prevent exploitation of the DLL hijacking vulnerability.

Fix

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

CVE-2024-48091

Affected Products

Tally Prime Edit Log

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2024-48091 · Security Note
• https://tallysolutions.com/download · Note
• https://t.me/cvedetector/17505 · Telegram Post
• https://gist.github.com/singhmanpreet493/0f1df7fa4e744a3317877ab85d187937#file-gistfile1-txt · Note
• https://twitter.com/CVEnew/status/1887898292400558237 · Twitter Post