Paper/Archive/CVE-2024-43772

CVE-2024-43772

Huachu Digital Technology Ltd. Easytest Online Test Platform — Huachu Easytest Online Learning Test Platform - SQL Injection

EPSS 0.5%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 42.0.420 × 208.4 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

SQL Injection in download student learning course function of Easytest Online Test Platform ver.24E01 and earlier allow remote attackers to execute arbitrary SQL commands via the uid parameter.

Affected

ProductAffectedFixed inSource

Easytest Online Test Platform≤ ver.24E01–CNA

easytest_online_learning_test_platform≤ 24e01–CISA-ADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

ZUSO ART (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

writeupzuso.ai/advisory/za-2024-05