CVE-2024-43775
Huachu Easytest Online Learning Test Platform - SQL Injection
- State
- Published
- Severity
- 8.7 High
- Published
- Sep 2, 2024
- Updated
- Sep 3, 2024
- Reserved
- Aug 16, 2024
Description
SQL Injection in search course titles function of Easytest Online Test Platform ver.24E01 and earlier allow remote authenticated users to execute arbitrary SQL commands via the search parameter.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | ZUSO ART |
Weaknesses
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected Products
| Product | Versions |
|---|---|
Easytest Online Test PlatformHuachu Digital Technology Ltd. |
|
References
- https://zuso.ai/advisory/za-2024-08third-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.