Lucene search

ZUSO ARTCVE-2024-7871

HistorySep 02, 2024 - 5:15 a.m.

CVE-2024-7871

2024-09-0205:15:17

CWE-89

ZUSO ART

web.nvd.nist.gov

sql injection

online dictionary

easytest online platform

remote authenticated users

arbitrary sql commands

word parameter

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS4

8.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/SC:N/VI:H/SI:N/VA:H/SA:N

AI Score

8.1

Confidence

Low

EPSS

0.001

Percentile

20.0%

JSON

SQL Injection in online dictionary function of Easytest Online Test Platform ver.24E01 and earlier allow remote authenticated users to execute arbitrary SQL commands via the word parameter.

Affected configurations

Nvd

Node

easytest_online_test_platform_projecteasytest_online_test_platformRange≤24e01

VendorProductVersionCPE
easytest_online_test_platform_projecteasytest_online_test_platform*cpe:2.3:a:easytest_online_test_platform_project:easytest_online_test_platform:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
easytest_online_test_platform_project	easytest_online_test_platform	*	cpe:2.3:a:easytest_online_test_platform_project:easytest_online_test_platform::::::::

CNA Affected

[
  {
    "defaultStatus": "affected",
    "product": "Easytest Online Test Platform",
    "vendor": "Huachu Digital Technology Ltd.",
    "versions": [
      {
        "lessThanOrEqual": "ver.24E01",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

References

zuso.ai/advisory/za-2024-04

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS4

8.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/SC:N/VI:H/SI:N/VA:H/SA:N

AI Score

8.1

Confidence

Low

EPSS

0.001

Percentile

20.0%

JSON

Related for CVE-2024-7871