← All advisories

Critical severity9.8NVD Advisory· Published Feb 16, 2024· Updated Jun 17, 2026

CVE-2024-25320

CVE-2024-25320

Description

Tongda OA v2017 and up to v11.9 was discovered to contain a SQL injection vulnerability via the $AFF_ID parameter at /affair/delete.php.

Affected products

4

Tongda2000/Office Anywhere2 versions
cpe:2.3:a:tongda2000:office_anywhere:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:tongda2000:office_anywhere:*:*:*:*:*:*:*:*range: >=11.0,<11.10
- cpe:2.3:a:tongda2000:office_anywhere:2017:*:*:*:*:*:*:*
Tongda/OAdescription
Tongda/OAllm-fuzzy
Range: 2017 - 11.9

Patches

Vulnerability mechanics

References

1

github.com/cqliuke/cve/blob/main/sql.mdnvdExploitThird Party Advisory

News mentions

0

No linked articles in our index yet.