CVE-2022-43436 HWA JIUH DIGITAL TECHNOLOGY LTD. EasyTest - Arbitrary File Upload

The File Upload function of EasyTest has insufficient filtering for special characters and file type. A remote attacker authenticated as a general user can upload and execute arbitrary files, to manipulate system or disrupt service...

CVE-2022-43437 HWA JIUH DIGITAL TECHNOLOGY LTD. EasyTest - SQL Injection

The Download function’s parameter of EasyTest has insufficient validation for user input. A remote attacker authenticated as a general user can inject arbitrary SQL command to access, modify or delete database...

CVE-2022-43438 HWA JIUH DIGITAL TECHNOLOGY LTD. EasyTest - Incorrect Authorization

The Administrator function of EasyTest has an Incorrect Authorization vulnerability. A remote attacker authenticated as a general user can exploit this vulnerability to bypass the intended access restrictions, to make API functions calls, manipulate system and terminate service...

PT-2023-14202 · Easytest · Easytest

Name of the Vulnerable Software and Affected Versions: EasyTest affected versions not specified Description: The Administrator function of EasyTest has an Incorrect Authorization issue. A remote attacker authenticated as a general user can exploit this to bypass intended access restrictions, make...

PT-2023-14201 · Easytest · Easytest

Name of the Vulnerable Software and Affected Versions: EasyTest affected versions not specified Description: The issue concerns insufficient validation of user input in the Download function's parameter, allowing a remote attacker authenticated as a general user to inject arbitrary SQL commands...

PT-2023-14200 · Easytest · Easytest

Name of the Vulnerable Software and Affected Versions: EasyTest affected versions not specified Description: The issue concerns the File Upload function of EasyTest, which lacks sufficient filtering for special characters and file types. This allows a remote attacker, authenticated as a general...

CVE-2022-43438

CVE-2022-43438 concerns EasyTest (by HWA JIUH DIGITAL TECHNOLOGY LTD). The Administrator function exposes an Incorrect Authorization flaw that allows an authenticated general-user to bypass access controls and perform restricted API calls, potentially manipulating the system and terminating servi...

CVE-2022-43437

Vulnerability: EasyTest (HWA JIUH DIGITAL TECHNOLOGY LTD.) has a SQL injection in the Download function parameter due to insufficient input validation. Root cause: lack of validation enables a remote attacker with general user privileges to inject arbitrary SQL commands and access/modify/delete t...

CVE-2022-43436

CVE-2022-43436 affects the EasyTest File Upload feature. The root cause is insufficient filtering for special characters and file types in the upload handler, allowing a remote attacker authenticated as a general user to upload and execute arbitrary files. Documented impact includes manipulation ...

CVE-2022-43436: Unrestricted Upload of File with Dangerous Type

The File Upload function of EasyTest has insufficient filtering for special characters and file type. A remote attacker authenticated as a general user can upload and execute arbitrary files, to manipulate system or disrupt service...

CVE-2022-43437: Improper Neutralization of Special Elements used in an SQL Command

The Download function’s parameter of EasyTest has insufficient validation for user input. A remote attacker authenticated as a general user can inject arbitrary SQL command to access, modify or delete database...

CVE-2022-43438: Incorrect Authorization

The Administrator function of EasyTest has an Incorrect Authorization vulnerability. A remote attacker authenticated as a general user can exploit this vulnerability to bypass the intended access restrictions, to make API functions calls, manipulate system and terminate service...

Easytest licensing issue vulnerability

Easytest is an online learning quiz platform of China's Huaju Digital Technology, Inc. Easytest is vulnerable to authorization issues, which can be exploited by remote attackers to access user and administrator account information other than passwords by constructing URL parameters after gaining...

Easytest SQL Injection Vulnerability

Easytest is an online learning quiz platform of China's Hua Ju Digital Technology, Inc. Easytest is vulnerable to SQL injection, which can be exploited by attackers to inject SQL commands into the parameters of the elective course management page after gaining user privileges to gain all database...

Easytest SQL Injection Vulnerability (CNVD-2021-83597)

Easytest is an online learning quiz platform of China's Hua Ju Digital Technology, Inc. Easytest is vulnerable to SQL injection, which can be exploited by attackers to inject SQL commands into the parameters of the learning history page after gaining user privileges to access all databases and ga...

CVE-2021-42336

The learning history page of the Easytest is vulnerable by permission bypass. After obtaining a user’s permission, remote attackers can access other users’ and administrator’s account information except password by crafting URL parameters...

CVE-2021-42336

The learning history page of the Easytest is vulnerable by permission bypass. After obtaining a user’s permission, remote attackers can access other users’ and administrator’s account information except password by crafting URL parameters...

CVE-2021-42335

Easytest bulletin board management function of online learning platform does not filter special characters. After obtaining a user’s privilege, remote attackers can inject JavaScript and execute stored XSS attack...

CVE-2021-42333

The Easytest contains SQL injection vulnerabilities. After obtaining user’s privilege, remote attackers can inject SQL commands into the parameters of the learning history page to access all database and obtain administrator permissions...

CVE-2021-42333

The Easytest contains SQL injection vulnerabilities. After obtaining user’s privilege, remote attackers can inject SQL commands into the parameters of the learning history page to access all database and obtain administrator permissions...