Medium severity5.5NVD Advisory· Published Feb 6, 2024· Updated Jun 17, 2026
CVE-2024-1251
CVE-2024-1251
Description
A vulnerability classified as critical has been found in Tongda OA 2017 up to 11.10. Affected is an unknown function of the file /general/email/outbox/delete.php. The manipulation of the argument DELETE_STR leads to sql injection. The exploit has been disclosed to the public and may be used. VDB-252990 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Affected products
4cpe:2.3:a:tongda2000:office_anywhere:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:tongda2000:office_anywhere:*:*:*:*:*:*:*:*range: >=11.0,<=11.10
- cpe:2.3:a:tongda2000:office_anywhere:2017:*:*:*:*:*:*:*
Patches
Vulnerability mechanics
References
3- github.com/rockersiyuan/CVE/blob/main/TongDa%20Sql%20inject.mdnvdExploit
- vuldb.comnvdPermissions RequiredThird Party Advisory
- vuldb.comnvdPermissions RequiredThird Party Advisory
News mentions
0No linked articles in our index yet.