CVE-2023-6276 MEDIUM

CVE-2023-6276: Tongda OA 2017 delete.php sql injection

Vendor Tongda
Product OA 2017
Weakness CWE-89 · SQLi
Published November 24, 2023
Last update June 3, 2025
View on NVD All CVEs

CVSS base score

6.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

What the vulnerability does

01Description

A vulnerability classified as critical has been found in Tongda OA 2017 up to 11.9. This affects an unknown part of the file general/wiki/cp/ct/delete.php. The manipulation of the argument PROJ_ID_STR leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 11.10 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-246105 was assigned to this vulnerability.

Key dates

02Disclosure timeline

November 24, 2023 CVE published
June 3, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2023-48720 Student Result Management System v1.0 - Multiple Unauthenticated SQL Injections (SQLi) CVE-2020-3450 Cisco Vision Dynamic Signage Director SQL Injection Vulnerability CVE-2023-0531 SourceCodester Online Tours & Travels Management System booking_report.php sql injection CVE-2026-2503 ElementCamp <= 2.3.6 - Authenticated (Author+) SQL Injection via 'meta_query[compare]' Parameter CVE-2026-5019 code-projects Simple Food Order System Parameter all-orders.php sql injection