CVE-2023-7021 MEDIUM

CVE-2023-7021: Tongda OA 2017 delete_search.php sql injection

Vendor Tongda
Product OA 2017
Weakness CWE-89 · SQLi
Published December 21, 2023
Last update August 2, 2024
View on NVD All CVEs

CVSS base score

6.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

What the vulnerability does

01Description

A vulnerability was found in Tongda OA 2017 up to 11.9. It has been classified as critical. Affected is an unknown function of the file general/vehicle/checkup/delete_search.php. The manipulation of the argument VU_ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 11.10 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-248568. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Key dates

02Disclosure timeline

December 21, 2023 CVE published
August 2, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-6483 code-projects Simple Pizza Ordering System edituser.php sql injection CVE-2025-2657 projectworlds Apartment Visitors Management System front.php sql injection CVE-2025-24667 WordPress Small Package Quotes Plugin <= 5.2.17 - SQL Injection vulnerability CVE-2024-5393 itsourcecode Online Student Enrollment System listofcourse.php sql injection CVE-2023-36508 WordPress Contact Form to DB by BestWebSoft Plugin <= 1.7.1 is vulnerable to SQL Injection