CVE-2021-22859

EIC e-document system - SQL Injection

State: Published
Severity: 9.8 Critical
Published: Mar 17, 2021
Updated: Sep 16, 2024
Reserved: Jan 6, 2021

Description

The users’ data querying function of EIC e-document system does not filter the special characters which resulted in remote attackers can inject SQL syntax and execute arbitrary commands without privilege.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	twcert

Weaknesses

CWE-89 SQL Injection

Affected Products

Product	Versions
e-document systemExcellent Infotek Corporation	0 3.0.2Affected

References

https://www.twcert.org.tw/tw/cp-132-4517-51e25-1.html
https://gist.github.com/tonykuo76/807c838b75879b0d327782dfcd2c3bea
https://www.chtsecurity.com/news/c974fd28-c19b-4003-82f3-818904057496

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.