Lucene search

ZUSO ARTVULNRICHMENT:CVE-2024-7871

HistorySep 02, 2024 - 4:00 a.m.

CVE-2024-7871 Huachu Easytest Online Learning Test Platform - SQL Injection

2024-09-0204:00:24

CWE-89

ZUSO ART

github.com

cve-2024-7871

sql injection

easytest online learning platform

CVSS4

8.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/SC:N/VI:H/SI:N/VA:H/SA:N

AI Score

8.5

Confidence

Low

EPSS

0.001

Percentile

20.0%

SSVC

Exploitation

none

Automatable

Technical Impact

total

JSON

SQL Injection in online dictionary function of Easytest Online Test Platform ver.24E01 and earlier allow remote authenticated users to execute arbitrary SQL commands via the word parameter.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:huaju:easytest_online_learning_test_platform:*:*:*:*:*:*:*:*"
    ],
    "vendor": "huaju",
    "product": "easytest_online_learning_test_platform",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "custom",
        "lessThanOrEqual": "24e01"
      }
    ],
    "defaultStatus": "affected"
  }
]

References

zuso.ai/advisory/za-2024-04