CVE-2024-10615

CVE-2024-10615 affects Tongda OA 2017 up to 11.10. The vulnerability is in /general/approve_center/query/list/input_form/delete_data_attach.php, where manipulating the RUN_ID parameter leads to SQL injection. Exploitation may be remote and the exploit has been disclosed publicly. Multiple sources...

CVE-2024-10616

The CVE-2024-10616 entry concerns Tongda OA (up to 11.9) with a SQL injection in the saleId parameter of /pda/workflow/webSignSubmit.php. The vulnerability, exploitable remotely, is caused by improper handling of input leading to database query manipulation. Publicly disclosed exploit details are...

CVE-2024-25320

Tongda OA v2017–v11.9 is reported to contain a SQL injection vulnerability in the /affair/delete.php endpoint via the $AFF_ID parameter. Affected component: server-side PHP logic handling the parameter. Impact is severe (CVE-2024-25320, CVSS v3.1: 9.8, Confidentiality/Integrity/Availability all H...

CVE-2024-10600

CVE-2024-10600 affects Tongda OA 2017 versions up to 11.6. The vulnerability resides in an unknown function within pda/appcenter/submenu.php, where manipulating the appid parameter causes a SQL injection. It allows remote exploitation, and public disclosure of the exploit is noted. Remediation in...

CVE-2023-7023

Tongda OA 2017 up to 11.9 contains a SQL injection in general/vehicle/query/delete.php via the VU_ID parameter. The issue can be exploited remotely, and the exploit has been publicly disclosed. Upgrading to version 11.10 addresses the vulnerability. Affected product/version: Tongda OA 2017 (≤11.9...

CVE-2024-10598

Tongda OA versions 11.2–11.6 are affected by a vulnerability in the Annual Leave Handler’s file general/hr/setting/attendance/leave/data.php, caused by improper authorization. The issue allows remote access and exploitation, with public exploits disclosed. Remediation per PT security guidance: up...

CVE-2024-10599

CVE-2024-10599 affects Tongda OA 2017 up to version 11.7. The vulnerability arises from improper handling of the file /inc/package_static_resources.php, leading to resource consumption that can be triggered remotely. Multiple sources confirm the issue and disclose that an exploit exists. Remediat...

CVE-2023-7180

CVE-2023-7180 affects Tongda OA 2017 up to 11.9. The vulnerability exists in the file general/project/proj/delete.php where manipulating the PROJ_ID_STR parameter allows SQL injection. Public exploit information is indicated, and upgrading to version 11.10 is said to address the issue. The issue ...

CVE-2024-10730

CVE-2024-10730 affects Tongda OA up to 11.6. A SQL injection vulnerability exists in /pda/appcenter/web_show.php through the ID parameter, potentially exploitable remotely. The vulnerability has been publicly disclosed. Remediation: patch immediately to a fixed version and/or apply the guidance f...

CVE-2024-1251

CVE-2024-1251 affects Tongda OA 2017 up to version 11.10. The vulnerable component is the file /general/email/outbox/delete.php, where manipulation of the parameter DELETE_STR enables a SQL injection. The vulnerability is described as critical with public exploit availability and has a high impac...

CVE-2024-10732

Tongda OA 2017 up to 11.10 is affected by a SQL injection in /module/word_model/view/index.php via the query_str argument. Root cause: input manipulation leads to injection; attack can be launched remotely and exploit is publicly disclosed. Affected product/module: Tongda OA 2017 (up to 11.10), v...

CVE-2023-7022

CVE-2023-7022 affects Tongda OA 2017 up to 11.9. The vulnerability resides in the file general/work_plan/manage/delete_all.php, where altering the parameter DELETE_STR enables SQL injection. It can be exploited remotely over the network, and the exploit has been disclosed publicly. Multiple sourc...

CVE-2024-10656

CVE-2024-10656 affects Tongda OA 2017 up to 11.9. The vulnerability is a SQL injection in the /pda/meeting/apply.php endpoint, triggered by manipulating the parameter mr_id . It can be exploited remotely and has been publicly disclosed. Connected sources consistently describe this issue as critic...

CVE-2023-7021

CVE-2023-7021 affects Tongda OA 2017 up to v11.9. Affected is an unknown function in the file general/vehicle/checkup/delete_search.php where manipulating the VU_ID parameter leads to a SQL injection. The vulnerability can be exploited remotely and the exploit has been disclosed publicly. Upgradi...

CVE-2024-0938

CVE-2024-0938 affects Tongda OA 2017 up to v11.9. The vulnerability is an SQL injection in /general/email/inbox/delete_webmail.php, caused by improper handling of the WEBBODY_ID_STR parameter. This can lead to unauthorized data exposure or modification with network access (no user interaction req...

CVE-2024-10619

Tongda OA 2017 up to 11.10 contains a SQL injection in /pda/reportshop/next_detail.php via the repid parameter. The vulnerability is exploitable remotely and exploitation has been disclosed publicly. Affected component: the next_detail.php endpoint handling repid; root cause: unsanitized input le...

CVE-2023-7020

CVE-2023-7020 affects Tongda OA 2017 up to 11.9. The issue is a SQL injection caused by improper handling of the TEMP_ID parameter in general/wiki/cp/ct/view.php, enabling remote exploitation. The vulnerability’s impact is described as high, with a remote attacker potentially exploiting it after ...

CVE-2024-10731

Tongda OA

CVE-2024-10602

CVE-2024-10602 affects Tongda OA 2017 up to 11.9. The vulnerability is in the file /general/approve_center/list/input_form/data_picker_link.php where the dataSrc parameter manipulation leads to SQL injection . The exploit has been disclosed publicly and can be triggered remotely, with no authenti...

CVE-2024-10617

CVE-2024-10617 concerns Tongda OA (up to version 11.10). The vulnerability is a SQL injection in the file /pda/workflow/check_seal.php caused by unsafely handling the ID parameter, enabling remote exploitation. Multiple sources confirm impact is significant (auth not required, network access) wit...

CVE-2024-10618

CVE-2024-10618 affects Tongda OA 2017 up to 11.10. The vulnerability is a SQL injection in the repid parameter of /pda/reportshop/record_detail.php, exploitable remotely. Public exploit disclosure is noted. Connected sources (Red Hat/CVE lists, CNNVD, PT-Security, and Vuldb) consistently describe...

CVE-2023-5497

CVE-2023-5497 affects Tongda OA 2017 (version 11.10). The vulnerability is an SQL injection in the file general/hr/salary/welfare_manage/delete.php, triggered by manipulating the WELFARE_ID parameter. Impact is remote exploitation, with public disclosure of the exploit. The available connected do...

CVE-2024-10601

The CVE-2024-10601 refers to a SQL injection in Tongda OA 2017 up to 11.10, triggered by manipulating the where_repeat argument in /general/address/private/address/query/delete.php. Affects Tongda OA 2017 versions

CVE-2024-10658

CVE-2024-10658 affects Tongda OA up to 11.10. The vulnerability is an SQL injection in the file /pda/approve_center/check_seal.php triggered by manipulating the ID parameter. It is remote-accessible and has been publicly disclosed. Several sources identify a SQL injection impact on the affected f...

CVE-2019-9759

CVE-2019-9759 affects TONGDA Office Anywhere 10.18.190121. The vulnerability is a SQL Injection in the general/approve_center/list/input_form/work_handle.php’s run_id parameter, caused by improper input handling. Potential impact includes full confidentiality, integrity, and availability loss (pe...

CVE-2024-10657

CVE-2024-10657 : Tongda OA up to 11.10 contains a SQL injection in file /pda/approve_center/prcs_info.php via the RUN_ID argument. The vulnerability can be triggered remotely and exploitation has been disclosed publicly. The connected sources confirm the affected product and the vulnerable parame...

CVE-2024-10655

Technical summary: CVE-2024-10655 affects Tongda OA versions 2017 up to 11.9. The vulnerability is a SQL injection in the file /pda/reportshop/new.php, caused by improper handling of the repid parameter. Impact/behavior: exploitable remotely; exploitation has been disclosed publicly. Multiple sou...