SQL Injection in online dictionary function of Easytest Online Test Platform ver.24E01 and earlier allow remote authenticated users to execute arbitrary SQL commands via the word parameter.
References
| Link | Resource |
|---|---|
| https://zuso.ai/advisory/za-2024-04 | Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
04 Sep 2024, 17:34
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Easytest Online Test Platform Project easytest Online Test Platform
Easytest Online Test Platform Project |
|
| CPE | cpe:2.3:a:easytest_online_test_platform_project:easytest_online_test_platform:*:*:*:*:*:*:*:* | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.8 |
| CWE | CWE-89 | |
| References | () https://zuso.ai/advisory/za-2024-04 - Third Party Advisory |
02 Sep 2024, 05:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-09-02 05:15
Updated : 2024-09-04 17:34
NVD link : CVE-2024-7871
Mitre link : CVE-2024-7871
JSON object : View
Products Affected
easytest_online_test_platform_project
- easytest_online_test_platform
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')