Vulnerability-Lookup

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

Full-Text Search

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2024-7871 (GCVE-0-2024-7871)

Vulnerability from nvd – Published: 2024-09-02 04:00 – Updated: 2024-09-03 14:23

Title

Huachu Easytest Online Learning Test Platform - SQL Injection

Summary

SQL Injection in online dictionary function of Easytest Online Test Platform ver.24E01 and earlier allow remote authenticated users to execute arbitrary SQL commands via the word parameter.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-03 14:22 UTC

CWE

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Assigner

ZUSO ART CNA

CNA scorecard C 75/100 over 11 records in the last 180 days details

References

1 reference

URL	Tags
https://zuso.ai/advisory/za-2024-04	third-party-advisory

Impacted products

2 products

Vendor	Product	Version
Huachu Digital Technology Ltd.	Easytest Online Test Platform	Affected: 0 , ≤ ver.24E01 (custom)
huaju	easytest_online_learning_test_platform	Affected: 0 , ≤ 24e01 (custom) cpe:2.3:a:huaju:easytest_online_learning_test_platform::::::::

Date Public

2024-09-02 04:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:huaju:easytest_online_learning_test_platform:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "affected",
            "product": "easytest_online_learning_test_platform",
            "vendor": "huaju",
            "versions": [
              {
                "lessThanOrEqual": "24e01",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-7871",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-03T14:22:37.547061Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-03T14:23:19.390Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Easytest Online Test Platform",
          "vendor": "Huachu Digital Technology Ltd.",
          "versions": [
            {
              "lessThanOrEqual": "ver.24E01",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2024-09-02T04:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "SQL Injection in online dictionary function of Easytest Online Test Platform ver.24E01 and earlier allow remote authenticated users to execute arbitrary SQL commands via the word parameter."
            }
          ],
          "value": "SQL Injection in online dictionary function of Easytest Online Test Platform ver.24E01 and earlier allow remote authenticated users to execute arbitrary SQL commands via the word parameter."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-02T04:00:24.762Z",
        "orgId": "256c161b-b921-402b-8c3b-c6c9c14d5d88",
        "shortName": "ZUSO ART"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://zuso.ai/advisory/za-2024-04"
        }
      ],
      "source": {
        "defect": [
          "ZA-2024-04"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "Huachu Easytest Online Learning Test Platform - SQL Injection",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "256c161b-b921-402b-8c3b-c6c9c14d5d88",
    "assignerShortName": "ZUSO ART",
    "cveId": "CVE-2024-7871",
    "datePublished": "2024-09-02T04:00:24.762Z",
    "dateReserved": "2024-08-16T04:16:17.853Z",
    "dateUpdated": "2024-09-03T14:23:19.390Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-43776 (GCVE-0-2024-43776)

Vulnerability from nvd – Published: 2024-09-02 04:04 – Updated: 2024-09-03 14:18

Title

Huachu Easytest Online Learning Test Platform - SQL Injection

Summary

SQL Injection in mock exam function of Easytest Online Test Platform ver.24E01 and earlier allow remote authenticated users to execute arbitrary SQL commands via the qlevel parameter.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-03 14:15 UTC

CWE

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Assigner

ZUSO ART CNA

CNA scorecard C 75/100 over 11 records in the last 180 days details

References

1 reference

URL	Tags
https://zuso.ai/advisory/za-2024-09	third-party-advisory

Impacted products

2 products

Vendor	Product	Version
Huachu Digital Technology Ltd.	Easytest Online Test Platform	Affected: 0 , ≤ ver.24E01 (custom)
huaju	easytest_online_learning_test_platform	Affected: 0 , ≤ 24e01 (custom) cpe:2.3:a:huaju:easytest_online_learning_test_platform::::::::

Date Public

2024-09-02 04:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:huaju:easytest_online_learning_test_platform:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "affected",
            "product": "easytest_online_learning_test_platform",
            "vendor": "huaju",
            "versions": [
              {
                "lessThanOrEqual": "24e01",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-43776",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-03T14:15:06.415321Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-03T14:18:17.460Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Easytest Online Test Platform",
          "vendor": "Huachu Digital Technology Ltd.",
          "versions": [
            {
              "lessThanOrEqual": "ver.24E01",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2024-09-02T04:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "SQL Injection in mock exam function of Easytest Online Test Platform ver.24E01 and earlier allow remote authenticated users to execute arbitrary SQL commands via the qlevel parameter."
            }
          ],
          "value": "SQL Injection in mock exam function of Easytest Online Test Platform ver.24E01 and earlier allow remote authenticated users to execute arbitrary SQL commands via the qlevel parameter."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-02T04:04:00.285Z",
        "orgId": "256c161b-b921-402b-8c3b-c6c9c14d5d88",
        "shortName": "ZUSO ART"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://zuso.ai/advisory/za-2024-09"
        }
      ],
      "source": {
        "defect": [
          "ZA-2024-09"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "Huachu Easytest Online Learning Test Platform - SQL Injection",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "256c161b-b921-402b-8c3b-c6c9c14d5d88",
    "assignerShortName": "ZUSO ART",
    "cveId": "CVE-2024-43776",
    "datePublished": "2024-09-02T04:04:00.285Z",
    "dateReserved": "2024-08-16T04:16:15.860Z",
    "dateUpdated": "2024-09-03T14:18:17.460Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-43775 (GCVE-0-2024-43775)

Vulnerability from nvd – Published: 2024-09-02 04:03 – Updated: 2024-09-03 14:19

Title

Huachu Easytest Online Learning Test Platform - SQL Injection

Summary

SQL Injection in search course titles function of Easytest Online Test Platform ver.24E01 and earlier allow remote authenticated users to execute arbitrary SQL commands via the search parameter.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-03 14:18 UTC

CWE

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Assigner

ZUSO ART CNA

CNA scorecard C 75/100 over 11 records in the last 180 days details

References

1 reference

URL	Tags
https://zuso.ai/advisory/za-2024-08	third-party-advisory

Impacted products

2 products

Vendor	Product	Version
Huachu Digital Technology Ltd.	Easytest Online Test Platform	Affected: 0 , ≤ ver.24E01 (custom)
huaju	easytest_online_learning_test_platform	Affected: 0 , ≤ 24e01 (custom) cpe:2.3:a:huaju:easytest_online_learning_test_platform::::::::

Date Public

2024-09-02 04:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:huaju:easytest_online_learning_test_platform:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "affected",
            "product": "easytest_online_learning_test_platform",
            "vendor": "huaju",
            "versions": [
              {
                "lessThanOrEqual": "24e01",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-43775",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-03T14:18:43.138994Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-03T14:19:21.591Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Easytest Online Test Platform",
          "vendor": "Huachu Digital Technology Ltd.",
          "versions": [
            {
              "lessThanOrEqual": "ver.24E01",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2024-09-02T04:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "SQL Injection in search course titles function of Easytest Online Test Platform ver.24E01 and earlier allow remote authenticated users to execute arbitrary SQL commands via the search parameter."
            }
          ],
          "value": "SQL Injection in search course titles function of Easytest Online Test Platform ver.24E01 and earlier allow remote authenticated users to execute arbitrary SQL commands via the search parameter."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-02T04:03:26.336Z",
        "orgId": "256c161b-b921-402b-8c3b-c6c9c14d5d88",
        "shortName": "ZUSO ART"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://zuso.ai/advisory/za-2024-08"
        }
      ],
      "source": {
        "defect": [
          "ZA-2024-08"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "Huachu Easytest Online Learning Test Platform - SQL Injection",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "256c161b-b921-402b-8c3b-c6c9c14d5d88",
    "assignerShortName": "ZUSO ART",
    "cveId": "CVE-2024-43775",
    "datePublished": "2024-09-02T04:03:26.336Z",
    "dateReserved": "2024-08-16T04:16:15.860Z",
    "dateUpdated": "2024-09-03T14:19:21.591Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-43774 (GCVE-0-2024-43774)

Vulnerability from nvd – Published: 2024-09-02 04:02 – Updated: 2024-09-03 14:20

Title

Huachu Easytest Online Learning Test Platform - SQL Injection

Summary

SQL Injection in download personal learning course function of Easytest Online Test Platform ver.24E01 and earlier allow remote authenticated users to execute arbitrary SQL commands via the uid parameter.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-03 14:20 UTC

CWE

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Assigner

ZUSO ART CNA

CNA scorecard C 75/100 over 11 records in the last 180 days details

References

1 reference

URL	Tags
https://zuso.ai/advisory/za-2024-07	third-party-advisory

Impacted products

2 products

Vendor	Product	Version
Huachu Digital Technology Ltd.	Easytest Online Test Platform	Affected: 0 , ≤ ver.24E01 (custom)
huaju	easytest_online_learning_test_platform	Affected: 0 , ≤ 24e01 (custom) cpe:2.3:a:huaju:easytest_online_learning_test_platform::::::::

Date Public

2024-09-02 04:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:huaju:easytest_online_learning_test_platform:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "affected",
            "product": "easytest_online_learning_test_platform",
            "vendor": "huaju",
            "versions": [
              {
                "lessThanOrEqual": "24e01",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-43774",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-03T14:20:01.275067Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-03T14:20:34.228Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Easytest Online Test Platform",
          "vendor": "Huachu Digital Technology Ltd.",
          "versions": [
            {
              "lessThanOrEqual": "ver.24E01",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2024-09-02T04:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "SQL Injection in download personal learning course function of Easytest Online Test Platform ver.24E01 and earlier allow remote authenticated users to execute arbitrary SQL commands via the uid parameter."
            }
          ],
          "value": "SQL Injection in download personal learning course function of Easytest Online Test Platform ver.24E01 and earlier allow remote authenticated users to execute arbitrary SQL commands via the uid parameter."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-02T04:02:47.465Z",
        "orgId": "256c161b-b921-402b-8c3b-c6c9c14d5d88",
        "shortName": "ZUSO ART"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://zuso.ai/advisory/za-2024-07"
        }
      ],
      "source": {
        "defect": [
          "ZA-2024-07"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "Huachu Easytest Online Learning Test Platform - SQL Injection",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "256c161b-b921-402b-8c3b-c6c9c14d5d88",
    "assignerShortName": "ZUSO ART",
    "cveId": "CVE-2024-43774",
    "datePublished": "2024-09-02T04:02:47.465Z",
    "dateReserved": "2024-08-16T04:16:15.860Z",
    "dateUpdated": "2024-09-03T14:20:34.228Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-43773 (GCVE-0-2024-43773)

Vulnerability from nvd – Published: 2024-09-02 04:01 – Updated: 2024-09-03 14:21

Title

Huachu Easytest Online Learning Test Platform - SQL Injection

Summary

SQL Injection in download class learning course function of Easytest Online Test Platform ver.24E01 and earlier allow remote attackers to execute arbitrary SQL commands via the cstr parameter.

Severity

9.3 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-03 14:20 UTC

CWE

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Assigner

ZUSO ART CNA

CNA scorecard C 75/100 over 11 records in the last 180 days details

References

1 reference

URL	Tags
https://zuso.ai/advisory/za-2024-06	third-party-advisory

Impacted products

2 products

Vendor	Product	Version
Huachu Digital Technology Ltd.	Easytest Online Test Platform	Affected: 0 , ≤ ver.24E01 (custom)
huaju	easytest_online_learning_test_platform	Affected: 0 , ≤ 24e01 (custom) cpe:2.3:a:huaju:easytest_online_learning_test_platform::::::::

Date Public

2024-09-02 04:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:huaju:easytest_online_learning_test_platform:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "affected",
            "product": "easytest_online_learning_test_platform",
            "vendor": "huaju",
            "versions": [
              {
                "lessThanOrEqual": "24e01",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-43773",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-03T14:20:58.191306Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-03T14:21:34.214Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Easytest Online Test Platform",
          "vendor": "Huachu Digital Technology Ltd.",
          "versions": [
            {
              "lessThanOrEqual": "ver.24E01",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2024-09-02T04:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "SQL Injection in download class learning course function of Easytest Online Test Platform ver.24E01 and earlier allow remote attackers to execute arbitrary SQL commands via the cstr parameter."
            }
          ],
          "value": "SQL Injection in download class learning course function of Easytest Online Test Platform ver.24E01 and earlier allow remote attackers to execute arbitrary SQL commands via the cstr parameter."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-02T04:01:43.939Z",
        "orgId": "256c161b-b921-402b-8c3b-c6c9c14d5d88",
        "shortName": "ZUSO ART"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://zuso.ai/advisory/za-2024-06"
        }
      ],
      "source": {
        "defect": [
          "ZA-2024-06"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "Huachu Easytest Online Learning Test Platform - SQL Injection",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "256c161b-b921-402b-8c3b-c6c9c14d5d88",
    "assignerShortName": "ZUSO ART",
    "cveId": "CVE-2024-43773",
    "datePublished": "2024-09-02T04:01:43.939Z",
    "dateReserved": "2024-08-16T04:16:15.860Z",
    "dateUpdated": "2024-09-03T14:21:34.214Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-43772 (GCVE-0-2024-43772)

Vulnerability from nvd – Published: 2024-09-02 04:01 – Updated: 2024-09-03 14:22

Title

Huachu Easytest Online Learning Test Platform - SQL Injection

Summary

SQL Injection in download student learning course function of Easytest Online Test Platform ver.24E01 and earlier allow remote attackers to execute arbitrary SQL commands via the uid parameter.

Severity

9.3 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-03 14:21 UTC

CWE

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Assigner

ZUSO ART CNA

CNA scorecard C 75/100 over 11 records in the last 180 days details

References

1 reference

URL	Tags
https://zuso.ai/advisory/za-2024-05	third-party-advisory

Impacted products

2 products

Vendor	Product	Version
Huachu Digital Technology Ltd.	Easytest Online Test Platform	Affected: 0 , ≤ ver.24E01 (custom)
huaju	easytest_online_learning_test_platform	Affected: 0 , ≤ 24e01 (custom) cpe:2.3:a:huaju:easytest_online_learning_test_platform::::::::

Date Public

2024-09-02 04:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:huaju:easytest_online_learning_test_platform:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "affected",
            "product": "easytest_online_learning_test_platform",
            "vendor": "huaju",
            "versions": [
              {
                "lessThanOrEqual": "24e01",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-43772",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-03T14:21:48.526972Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-03T14:22:18.337Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Easytest Online Test Platform",
          "vendor": "Huachu Digital Technology Ltd.",
          "versions": [
            {
              "lessThanOrEqual": "ver.24E01",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2024-09-02T04:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "SQL Injection in download student learning course function of Easytest Online Test Platform ver.24E01 and earlier allow remote attackers to execute arbitrary SQL commands via the uid parameter."
            }
          ],
          "value": "SQL Injection in download student learning course function of Easytest Online Test Platform ver.24E01 and earlier allow remote attackers to execute arbitrary SQL commands via the uid parameter."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-02T04:01:03.389Z",
        "orgId": "256c161b-b921-402b-8c3b-c6c9c14d5d88",
        "shortName": "ZUSO ART"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://zuso.ai/advisory/za-2024-05"
        }
      ],
      "source": {
        "defect": [
          "ZA-2024-05"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "Huachu Easytest Online Learning Test Platform - SQL Injection",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "256c161b-b921-402b-8c3b-c6c9c14d5d88",
    "assignerShortName": "ZUSO ART",
    "cveId": "CVE-2024-43772",
    "datePublished": "2024-09-02T04:01:03.389Z",
    "dateReserved": "2024-08-16T04:16:15.860Z",
    "dateUpdated": "2024-09-03T14:22:18.337Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-42336 (GCVE-0-2021-42336)

Vulnerability from nvd – Published: 2021-10-15 12:10 – Updated: 2024-09-16 16:33

Title

Huachu Digital Technology Co.,Ltd. Easytest - Improper Authorization

Summary

The learning history page of the Easytest is vulnerable by permission bypass. After obtaining a user’s permission, remote attackers can access other users’ and administrator’s account information except password by crafting URL parameters.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CWE

CWE-285 - Improper Authorization

Assigner

twcert CNA under the mitre root

CNA scorecard B 82/100 over 98 records in the last 180 days details

References

1 reference

URL	Tags
https://www.twcert.org.tw/tw/cp-132-5205-1de5a-1.html	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Huachu Digital Technology Co.,Ltd.	Easytest	Affected: 1705

Date Public

2021-10-15 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T03:30:38.261Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.twcert.org.tw/tw/cp-132-5205-1de5a-1.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Easytest",
          "vendor": "Huachu Digital Technology Co.,Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "1705"
            }
          ]
        }
      ],
      "datePublic": "2021-10-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The learning history page of the Easytest is vulnerable by permission bypass. After obtaining a user\u2019s permission, remote attackers can access other users\u2019 and administrator\u2019s account information except password by crafting URL parameters."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285 Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-10-15T12:10:40.000Z",
        "orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
        "shortName": "twcert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.twcert.org.tw/tw/cp-132-5205-1de5a-1.html"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Update Easytest to version 2100"
        }
      ],
      "source": {
        "advisory": "TVN-202110008",
        "discovery": "EXTERNAL"
      },
      "title": "Huachu Digital Technology Co.,Ltd. Easytest - Improper Authorization",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "AKA": "TWCERT/CC",
          "ASSIGNER": "cve@cert.org.tw",
          "DATE_PUBLIC": "2021-10-15T11:57:00.000Z",
          "ID": "CVE-2021-42336",
          "STATE": "PUBLIC",
          "TITLE": "Huachu Digital Technology Co.,Ltd. Easytest - Improper Authorization"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Easytest",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "1705"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Huachu Digital Technology Co.,Ltd."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The learning history page of the Easytest is vulnerable by permission bypass. After obtaining a user\u2019s permission, remote attackers can access other users\u2019 and administrator\u2019s account information except password by crafting URL parameters."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-285 Improper Authorization"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.twcert.org.tw/tw/cp-132-5205-1de5a-1.html",
              "refsource": "MISC",
              "url": "https://www.twcert.org.tw/tw/cp-132-5205-1de5a-1.html"
            }
          ]
        },
        "solution": [
          {
            "lang": "en",
            "value": "Update Easytest to version 2100"
          }
        ],
        "source": {
          "advisory": "TVN-202110008",
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
    "assignerShortName": "twcert",
    "cveId": "CVE-2021-42336",
    "datePublished": "2021-10-15T12:10:40.380Z",
    "dateReserved": "2021-10-12T00:00:00.000Z",
    "dateUpdated": "2024-09-16T16:33:19.781Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-42335 (GCVE-0-2021-42335)

Vulnerability from nvd – Published: 2021-10-15 12:10 – Updated: 2024-09-16 19:05

Title

Huachu Digital Technology Co.,Ltd. Easytest - Stored XSS

Summary

Easytest bulletin board management function of online learning platform does not filter special characters. After obtaining a user’s privilege, remote attackers can inject JavaScript and execute stored XSS attack.

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CWE

CWE-79 - Cross-site Scripting (XSS)

Assigner

twcert CNA under the mitre root

CNA scorecard B 82/100 over 98 records in the last 180 days details

References

1 reference

URL	Tags
https://www.twcert.org.tw/tw/cp-132-5206-3cd3f-1.html	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Huachu Digital Technology Co.,Ltd.	Easytest	Affected: 1705

Date Public

2021-10-15 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T03:30:38.430Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.twcert.org.tw/tw/cp-132-5206-3cd3f-1.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Easytest",
          "vendor": "Huachu Digital Technology Co.,Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "1705"
            }
          ]
        }
      ],
      "datePublic": "2021-10-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Easytest bulletin board management function of online learning platform does not filter special characters. After obtaining a user\u2019s privilege, remote attackers can inject JavaScript and execute stored XSS attack."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Cross-site Scripting (XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-10-15T12:10:38.000Z",
        "orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
        "shortName": "twcert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.twcert.org.tw/tw/cp-132-5206-3cd3f-1.html"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Update Easytest to version 2100"
        }
      ],
      "source": {
        "advisory": "TVN-202110007",
        "discovery": "EXTERNAL"
      },
      "title": "Huachu Digital Technology Co.,Ltd. Easytest - Stored XSS",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "AKA": "TWCERT/CC",
          "ASSIGNER": "cve@cert.org.tw",
          "DATE_PUBLIC": "2021-10-15T11:57:00.000Z",
          "ID": "CVE-2021-42335",
          "STATE": "PUBLIC",
          "TITLE": "Huachu Digital Technology Co.,Ltd. Easytest - Stored XSS"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Easytest",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "1705"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Huachu Digital Technology Co.,Ltd."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Easytest bulletin board management function of online learning platform does not filter special characters. After obtaining a user\u2019s privilege, remote attackers can inject JavaScript and execute stored XSS attack."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-79 Cross-site Scripting (XSS)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.twcert.org.tw/tw/cp-132-5206-3cd3f-1.html",
              "refsource": "MISC",
              "url": "https://www.twcert.org.tw/tw/cp-132-5206-3cd3f-1.html"
            }
          ]
        },
        "solution": [
          {
            "lang": "en",
            "value": "Update Easytest to version 2100"
          }
        ],
        "source": {
          "advisory": "TVN-202110007",
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
    "assignerShortName": "twcert",
    "cveId": "CVE-2021-42335",
    "datePublished": "2021-10-15T12:10:38.906Z",
    "dateReserved": "2021-10-12T00:00:00.000Z",
    "dateUpdated": "2024-09-16T19:05:14.166Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-42334 (GCVE-0-2021-42334)

Vulnerability from nvd – Published: 2021-10-15 12:10 – Updated: 2024-09-16 16:17

Title

Huachu Digital Technology Co.,Ltd. Easytest - SQL Injection-2

Summary

The Easytest contains SQL injection vulnerabilities. After obtaining a user’s privilege, remote attackers can inject SQL commands into the parameters of the elective course management page to obtain all database and administrator permissions.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-89 - SQL Injection

Assigner

twcert CNA under the mitre root

CNA scorecard B 82/100 over 98 records in the last 180 days details

References

1 reference

URL	Tags
https://www.twcert.org.tw/tw/cp-132-5204-f80ad-1.html	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Huachu Digital Technology Co.,Ltd.	Easytest	Affected: 1705

Date Public

2021-10-15 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T03:30:38.253Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.twcert.org.tw/tw/cp-132-5204-f80ad-1.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Easytest",
          "vendor": "Huachu Digital Technology Co.,Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "1705"
            }
          ]
        }
      ],
      "datePublic": "2021-10-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The Easytest contains SQL injection vulnerabilities. After obtaining a user\u2019s privilege, remote attackers can inject SQL commands into the parameters of the elective course management page to obtain all database and administrator permissions."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 SQL Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-10-15T12:10:37.000Z",
        "orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
        "shortName": "twcert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.twcert.org.tw/tw/cp-132-5204-f80ad-1.html"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Update Easytest to version 2100"
        }
      ],
      "source": {
        "advisory": "TVN-202110006",
        "discovery": "EXTERNAL"
      },
      "title": "Huachu Digital Technology Co.,Ltd. Easytest - SQL Injection-2",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "AKA": "TWCERT/CC",
          "ASSIGNER": "cve@cert.org.tw",
          "DATE_PUBLIC": "2021-10-15T11:57:00.000Z",
          "ID": "CVE-2021-42334",
          "STATE": "PUBLIC",
          "TITLE": "Huachu Digital Technology Co.,Ltd. Easytest - SQL Injection-2"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Easytest",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "1705"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Huachu Digital Technology Co.,Ltd."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Easytest contains SQL injection vulnerabilities. After obtaining a user\u2019s privilege, remote attackers can inject SQL commands into the parameters of the elective course management page to obtain all database and administrator permissions."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-89 SQL Injection"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.twcert.org.tw/tw/cp-132-5204-f80ad-1.html",
              "refsource": "MISC",
              "url": "https://www.twcert.org.tw/tw/cp-132-5204-f80ad-1.html"
            }
          ]
        },
        "solution": [
          {
            "lang": "en",
            "value": "Update Easytest to version 2100"
          }
        ],
        "source": {
          "advisory": "TVN-202110006",
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
    "assignerShortName": "twcert",
    "cveId": "CVE-2021-42334",
    "datePublished": "2021-10-15T12:10:37.398Z",
    "dateReserved": "2021-10-12T00:00:00.000Z",
    "dateUpdated": "2024-09-16T16:17:44.540Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-42333 (GCVE-0-2021-42333)

Vulnerability from nvd – Published: 2021-10-15 12:10 – Updated: 2024-09-16 23:56

Title

Huachu Digital Technology Co.,Ltd. Easytest - SQL Injection-1

Summary

The Easytest contains SQL injection vulnerabilities. After obtaining user’s privilege, remote attackers can inject SQL commands into the parameters of the learning history page to access all database and obtain administrator permissions.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-89 - SQL Injection

Assigner

twcert CNA under the mitre root

CNA scorecard B 82/100 over 98 records in the last 180 days details

References

1 reference

URL	Tags
https://www.twcert.org.tw/tw/cp-132-5203-00de8-1.html	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Huachu Digital Technology Co.,Ltd.	Easytest	Affected: 1705

Date Public

2021-10-15 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T03:30:38.290Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.twcert.org.tw/tw/cp-132-5203-00de8-1.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Easytest",
          "vendor": "Huachu Digital Technology Co.,Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "1705"
            }
          ]
        }
      ],
      "datePublic": "2021-10-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The Easytest contains SQL injection vulnerabilities. After obtaining user\u2019s privilege, remote attackers can inject SQL commands into the parameters of the learning history page to access all database and obtain administrator permissions."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 SQL Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-10-15T12:10:35.000Z",
        "orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
        "shortName": "twcert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.twcert.org.tw/tw/cp-132-5203-00de8-1.html"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Update Easytest to version 2100"
        }
      ],
      "source": {
        "advisory": "TVN-202110005",
        "discovery": "EXTERNAL"
      },
      "title": "Huachu Digital Technology Co.,Ltd. Easytest - SQL Injection-1",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "AKA": "TWCERT/CC",
          "ASSIGNER": "cve@cert.org.tw",
          "DATE_PUBLIC": "2021-10-15T11:57:00.000Z",
          "ID": "CVE-2021-42333",
          "STATE": "PUBLIC",
          "TITLE": "Huachu Digital Technology Co.,Ltd. Easytest - SQL Injection-1"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Easytest",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "1705"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Huachu Digital Technology Co.,Ltd."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Easytest contains SQL injection vulnerabilities. After obtaining user\u2019s privilege, remote attackers can inject SQL commands into the parameters of the learning history page to access all database and obtain administrator permissions."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-89 SQL Injection"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.twcert.org.tw/tw/cp-132-5203-00de8-1.html",
              "refsource": "MISC",
              "url": "https://www.twcert.org.tw/tw/cp-132-5203-00de8-1.html"
            }
          ]
        },
        "solution": [
          {
            "lang": "en",
            "value": "Update Easytest to version 2100"
          }
        ],
        "source": {
          "advisory": "TVN-202110005",
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
    "assignerShortName": "twcert",
    "cveId": "CVE-2021-42333",
    "datePublished": "2021-10-15T12:10:35.859Z",
    "dateReserved": "2021-10-12T00:00:00.000Z",
    "dateUpdated": "2024-09-16T23:56:50.380Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-43776 (GCVE-0-2024-43776)

Vulnerability from cvelistv5 – Published: 2024-09-02 04:04 – Updated: 2024-09-03 14:18

Title

Huachu Easytest Online Learning Test Platform - SQL Injection

Summary

SQL Injection in mock exam function of Easytest Online Test Platform ver.24E01 and earlier allow remote authenticated users to execute arbitrary SQL commands via the qlevel parameter.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-03 14:15 UTC

CWE

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Assigner

ZUSO ART CNA

CNA scorecard C 75/100 over 11 records in the last 180 days details

References

1 reference

URL	Tags
https://zuso.ai/advisory/za-2024-09	third-party-advisory

Impacted products

2 products

Vendor	Product	Version
Huachu Digital Technology Ltd.	Easytest Online Test Platform	Affected: 0 , ≤ ver.24E01 (custom)
huaju	easytest_online_learning_test_platform	Affected: 0 , ≤ 24e01 (custom) cpe:2.3:a:huaju:easytest_online_learning_test_platform::::::::

Date Public

2024-09-02 04:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:huaju:easytest_online_learning_test_platform:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "affected",
            "product": "easytest_online_learning_test_platform",
            "vendor": "huaju",
            "versions": [
              {
                "lessThanOrEqual": "24e01",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-43776",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-03T14:15:06.415321Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-03T14:18:17.460Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Easytest Online Test Platform",
          "vendor": "Huachu Digital Technology Ltd.",
          "versions": [
            {
              "lessThanOrEqual": "ver.24E01",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2024-09-02T04:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "SQL Injection in mock exam function of Easytest Online Test Platform ver.24E01 and earlier allow remote authenticated users to execute arbitrary SQL commands via the qlevel parameter."
            }
          ],
          "value": "SQL Injection in mock exam function of Easytest Online Test Platform ver.24E01 and earlier allow remote authenticated users to execute arbitrary SQL commands via the qlevel parameter."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-02T04:04:00.285Z",
        "orgId": "256c161b-b921-402b-8c3b-c6c9c14d5d88",
        "shortName": "ZUSO ART"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://zuso.ai/advisory/za-2024-09"
        }
      ],
      "source": {
        "defect": [
          "ZA-2024-09"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "Huachu Easytest Online Learning Test Platform - SQL Injection",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "256c161b-b921-402b-8c3b-c6c9c14d5d88",
    "assignerShortName": "ZUSO ART",
    "cveId": "CVE-2024-43776",
    "datePublished": "2024-09-02T04:04:00.285Z",
    "dateReserved": "2024-08-16T04:16:15.860Z",
    "dateUpdated": "2024-09-03T14:18:17.460Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-43775 (GCVE-0-2024-43775)

Vulnerability from cvelistv5 – Published: 2024-09-02 04:03 – Updated: 2024-09-03 14:19

Title

Huachu Easytest Online Learning Test Platform - SQL Injection

Summary

SQL Injection in search course titles function of Easytest Online Test Platform ver.24E01 and earlier allow remote authenticated users to execute arbitrary SQL commands via the search parameter.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-03 14:18 UTC

CWE

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Assigner

ZUSO ART CNA

CNA scorecard C 75/100 over 11 records in the last 180 days details

References

1 reference

URL	Tags
https://zuso.ai/advisory/za-2024-08	third-party-advisory

Impacted products

2 products

Vendor	Product	Version
Huachu Digital Technology Ltd.	Easytest Online Test Platform	Affected: 0 , ≤ ver.24E01 (custom)
huaju	easytest_online_learning_test_platform	Affected: 0 , ≤ 24e01 (custom) cpe:2.3:a:huaju:easytest_online_learning_test_platform::::::::

Date Public

2024-09-02 04:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:huaju:easytest_online_learning_test_platform:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "affected",
            "product": "easytest_online_learning_test_platform",
            "vendor": "huaju",
            "versions": [
              {
                "lessThanOrEqual": "24e01",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-43775",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-03T14:18:43.138994Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-03T14:19:21.591Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Easytest Online Test Platform",
          "vendor": "Huachu Digital Technology Ltd.",
          "versions": [
            {
              "lessThanOrEqual": "ver.24E01",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2024-09-02T04:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "SQL Injection in search course titles function of Easytest Online Test Platform ver.24E01 and earlier allow remote authenticated users to execute arbitrary SQL commands via the search parameter."
            }
          ],
          "value": "SQL Injection in search course titles function of Easytest Online Test Platform ver.24E01 and earlier allow remote authenticated users to execute arbitrary SQL commands via the search parameter."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-02T04:03:26.336Z",
        "orgId": "256c161b-b921-402b-8c3b-c6c9c14d5d88",
        "shortName": "ZUSO ART"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://zuso.ai/advisory/za-2024-08"
        }
      ],
      "source": {
        "defect": [
          "ZA-2024-08"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "Huachu Easytest Online Learning Test Platform - SQL Injection",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "256c161b-b921-402b-8c3b-c6c9c14d5d88",
    "assignerShortName": "ZUSO ART",
    "cveId": "CVE-2024-43775",
    "datePublished": "2024-09-02T04:03:26.336Z",
    "dateReserved": "2024-08-16T04:16:15.860Z",
    "dateUpdated": "2024-09-03T14:19:21.591Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-43774 (GCVE-0-2024-43774)

Vulnerability from cvelistv5 – Published: 2024-09-02 04:02 – Updated: 2024-09-03 14:20

Title

Huachu Easytest Online Learning Test Platform - SQL Injection

Summary

SQL Injection in download personal learning course function of Easytest Online Test Platform ver.24E01 and earlier allow remote authenticated users to execute arbitrary SQL commands via the uid parameter.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-03 14:20 UTC

CWE

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Assigner

ZUSO ART CNA

CNA scorecard C 75/100 over 11 records in the last 180 days details

References

1 reference

URL	Tags
https://zuso.ai/advisory/za-2024-07	third-party-advisory

Impacted products

2 products

Vendor	Product	Version
Huachu Digital Technology Ltd.	Easytest Online Test Platform	Affected: 0 , ≤ ver.24E01 (custom)
huaju	easytest_online_learning_test_platform	Affected: 0 , ≤ 24e01 (custom) cpe:2.3:a:huaju:easytest_online_learning_test_platform::::::::

Date Public

2024-09-02 04:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:huaju:easytest_online_learning_test_platform:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "affected",
            "product": "easytest_online_learning_test_platform",
            "vendor": "huaju",
            "versions": [
              {
                "lessThanOrEqual": "24e01",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-43774",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-03T14:20:01.275067Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-03T14:20:34.228Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Easytest Online Test Platform",
          "vendor": "Huachu Digital Technology Ltd.",
          "versions": [
            {
              "lessThanOrEqual": "ver.24E01",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2024-09-02T04:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "SQL Injection in download personal learning course function of Easytest Online Test Platform ver.24E01 and earlier allow remote authenticated users to execute arbitrary SQL commands via the uid parameter."
            }
          ],
          "value": "SQL Injection in download personal learning course function of Easytest Online Test Platform ver.24E01 and earlier allow remote authenticated users to execute arbitrary SQL commands via the uid parameter."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-02T04:02:47.465Z",
        "orgId": "256c161b-b921-402b-8c3b-c6c9c14d5d88",
        "shortName": "ZUSO ART"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://zuso.ai/advisory/za-2024-07"
        }
      ],
      "source": {
        "defect": [
          "ZA-2024-07"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "Huachu Easytest Online Learning Test Platform - SQL Injection",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "256c161b-b921-402b-8c3b-c6c9c14d5d88",
    "assignerShortName": "ZUSO ART",
    "cveId": "CVE-2024-43774",
    "datePublished": "2024-09-02T04:02:47.465Z",
    "dateReserved": "2024-08-16T04:16:15.860Z",
    "dateUpdated": "2024-09-03T14:20:34.228Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-43773 (GCVE-0-2024-43773)

Vulnerability from cvelistv5 – Published: 2024-09-02 04:01 – Updated: 2024-09-03 14:21

Title

Huachu Easytest Online Learning Test Platform - SQL Injection

Summary

SQL Injection in download class learning course function of Easytest Online Test Platform ver.24E01 and earlier allow remote attackers to execute arbitrary SQL commands via the cstr parameter.

Severity

9.3 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-03 14:20 UTC

CWE

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Assigner

ZUSO ART CNA

CNA scorecard C 75/100 over 11 records in the last 180 days details

References

1 reference

URL	Tags
https://zuso.ai/advisory/za-2024-06	third-party-advisory

Impacted products

2 products

Vendor	Product	Version
Huachu Digital Technology Ltd.	Easytest Online Test Platform	Affected: 0 , ≤ ver.24E01 (custom)
huaju	easytest_online_learning_test_platform	Affected: 0 , ≤ 24e01 (custom) cpe:2.3:a:huaju:easytest_online_learning_test_platform::::::::

Date Public

2024-09-02 04:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:huaju:easytest_online_learning_test_platform:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "affected",
            "product": "easytest_online_learning_test_platform",
            "vendor": "huaju",
            "versions": [
              {
                "lessThanOrEqual": "24e01",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-43773",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-03T14:20:58.191306Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-03T14:21:34.214Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Easytest Online Test Platform",
          "vendor": "Huachu Digital Technology Ltd.",
          "versions": [
            {
              "lessThanOrEqual": "ver.24E01",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2024-09-02T04:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "SQL Injection in download class learning course function of Easytest Online Test Platform ver.24E01 and earlier allow remote attackers to execute arbitrary SQL commands via the cstr parameter."
            }
          ],
          "value": "SQL Injection in download class learning course function of Easytest Online Test Platform ver.24E01 and earlier allow remote attackers to execute arbitrary SQL commands via the cstr parameter."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-02T04:01:43.939Z",
        "orgId": "256c161b-b921-402b-8c3b-c6c9c14d5d88",
        "shortName": "ZUSO ART"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://zuso.ai/advisory/za-2024-06"
        }
      ],
      "source": {
        "defect": [
          "ZA-2024-06"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "Huachu Easytest Online Learning Test Platform - SQL Injection",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "256c161b-b921-402b-8c3b-c6c9c14d5d88",
    "assignerShortName": "ZUSO ART",
    "cveId": "CVE-2024-43773",
    "datePublished": "2024-09-02T04:01:43.939Z",
    "dateReserved": "2024-08-16T04:16:15.860Z",
    "dateUpdated": "2024-09-03T14:21:34.214Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-43772 (GCVE-0-2024-43772)

Vulnerability from cvelistv5 – Published: 2024-09-02 04:01 – Updated: 2024-09-03 14:22

Title

Huachu Easytest Online Learning Test Platform - SQL Injection

Summary

SQL Injection in download student learning course function of Easytest Online Test Platform ver.24E01 and earlier allow remote attackers to execute arbitrary SQL commands via the uid parameter.

Severity

9.3 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-03 14:21 UTC

CWE

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Assigner

ZUSO ART CNA

CNA scorecard C 75/100 over 11 records in the last 180 days details

References

1 reference

URL	Tags
https://zuso.ai/advisory/za-2024-05	third-party-advisory

Impacted products

2 products

Vendor	Product	Version
Huachu Digital Technology Ltd.	Easytest Online Test Platform	Affected: 0 , ≤ ver.24E01 (custom)
huaju	easytest_online_learning_test_platform	Affected: 0 , ≤ 24e01 (custom) cpe:2.3:a:huaju:easytest_online_learning_test_platform::::::::

Date Public

2024-09-02 04:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:huaju:easytest_online_learning_test_platform:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "affected",
            "product": "easytest_online_learning_test_platform",
            "vendor": "huaju",
            "versions": [
              {
                "lessThanOrEqual": "24e01",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-43772",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-03T14:21:48.526972Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-03T14:22:18.337Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Easytest Online Test Platform",
          "vendor": "Huachu Digital Technology Ltd.",
          "versions": [
            {
              "lessThanOrEqual": "ver.24E01",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2024-09-02T04:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "SQL Injection in download student learning course function of Easytest Online Test Platform ver.24E01 and earlier allow remote attackers to execute arbitrary SQL commands via the uid parameter."
            }
          ],
          "value": "SQL Injection in download student learning course function of Easytest Online Test Platform ver.24E01 and earlier allow remote attackers to execute arbitrary SQL commands via the uid parameter."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-02T04:01:03.389Z",
        "orgId": "256c161b-b921-402b-8c3b-c6c9c14d5d88",
        "shortName": "ZUSO ART"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://zuso.ai/advisory/za-2024-05"
        }
      ],
      "source": {
        "defect": [
          "ZA-2024-05"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "Huachu Easytest Online Learning Test Platform - SQL Injection",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "256c161b-b921-402b-8c3b-c6c9c14d5d88",
    "assignerShortName": "ZUSO ART",
    "cveId": "CVE-2024-43772",
    "datePublished": "2024-09-02T04:01:03.389Z",
    "dateReserved": "2024-08-16T04:16:15.860Z",
    "dateUpdated": "2024-09-03T14:22:18.337Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-7871 (GCVE-0-2024-7871)

Vulnerability from cvelistv5 – Published: 2024-09-02 04:00 – Updated: 2024-09-03 14:23

Title

Huachu Easytest Online Learning Test Platform - SQL Injection

Summary

SQL Injection in online dictionary function of Easytest Online Test Platform ver.24E01 and earlier allow remote authenticated users to execute arbitrary SQL commands via the word parameter.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-03 14:22 UTC

CWE

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Assigner

ZUSO ART CNA

CNA scorecard C 75/100 over 11 records in the last 180 days details

References

1 reference

URL	Tags
https://zuso.ai/advisory/za-2024-04	third-party-advisory

Impacted products

2 products

Vendor	Product	Version
Huachu Digital Technology Ltd.	Easytest Online Test Platform	Affected: 0 , ≤ ver.24E01 (custom)
huaju	easytest_online_learning_test_platform	Affected: 0 , ≤ 24e01 (custom) cpe:2.3:a:huaju:easytest_online_learning_test_platform::::::::

Date Public

2024-09-02 04:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:huaju:easytest_online_learning_test_platform:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "affected",
            "product": "easytest_online_learning_test_platform",
            "vendor": "huaju",
            "versions": [
              {
                "lessThanOrEqual": "24e01",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-7871",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-03T14:22:37.547061Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-03T14:23:19.390Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Easytest Online Test Platform",
          "vendor": "Huachu Digital Technology Ltd.",
          "versions": [
            {
              "lessThanOrEqual": "ver.24E01",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2024-09-02T04:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "SQL Injection in online dictionary function of Easytest Online Test Platform ver.24E01 and earlier allow remote authenticated users to execute arbitrary SQL commands via the word parameter."
            }
          ],
          "value": "SQL Injection in online dictionary function of Easytest Online Test Platform ver.24E01 and earlier allow remote authenticated users to execute arbitrary SQL commands via the word parameter."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-02T04:00:24.762Z",
        "orgId": "256c161b-b921-402b-8c3b-c6c9c14d5d88",
        "shortName": "ZUSO ART"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://zuso.ai/advisory/za-2024-04"
        }
      ],
      "source": {
        "defect": [
          "ZA-2024-04"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "Huachu Easytest Online Learning Test Platform - SQL Injection",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "256c161b-b921-402b-8c3b-c6c9c14d5d88",
    "assignerShortName": "ZUSO ART",
    "cveId": "CVE-2024-7871",
    "datePublished": "2024-09-02T04:00:24.762Z",
    "dateReserved": "2024-08-16T04:16:17.853Z",
    "dateUpdated": "2024-09-03T14:23:19.390Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-42336 (GCVE-0-2021-42336)

Vulnerability from cvelistv5 – Published: 2021-10-15 12:10 – Updated: 2024-09-16 16:33

Title

Huachu Digital Technology Co.,Ltd. Easytest - Improper Authorization

Summary

The learning history page of the Easytest is vulnerable by permission bypass. After obtaining a user’s permission, remote attackers can access other users’ and administrator’s account information except password by crafting URL parameters.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CWE

CWE-285 - Improper Authorization

Assigner

twcert CNA under the mitre root

CNA scorecard B 82/100 over 98 records in the last 180 days details

References

1 reference

URL	Tags
https://www.twcert.org.tw/tw/cp-132-5205-1de5a-1.html	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Huachu Digital Technology Co.,Ltd.	Easytest	Affected: 1705

Date Public

2021-10-15 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T03:30:38.261Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.twcert.org.tw/tw/cp-132-5205-1de5a-1.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Easytest",
          "vendor": "Huachu Digital Technology Co.,Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "1705"
            }
          ]
        }
      ],
      "datePublic": "2021-10-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The learning history page of the Easytest is vulnerable by permission bypass. After obtaining a user\u2019s permission, remote attackers can access other users\u2019 and administrator\u2019s account information except password by crafting URL parameters."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285 Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-10-15T12:10:40.000Z",
        "orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
        "shortName": "twcert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.twcert.org.tw/tw/cp-132-5205-1de5a-1.html"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Update Easytest to version 2100"
        }
      ],
      "source": {
        "advisory": "TVN-202110008",
        "discovery": "EXTERNAL"
      },
      "title": "Huachu Digital Technology Co.,Ltd. Easytest - Improper Authorization",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "AKA": "TWCERT/CC",
          "ASSIGNER": "cve@cert.org.tw",
          "DATE_PUBLIC": "2021-10-15T11:57:00.000Z",
          "ID": "CVE-2021-42336",
          "STATE": "PUBLIC",
          "TITLE": "Huachu Digital Technology Co.,Ltd. Easytest - Improper Authorization"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Easytest",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "1705"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Huachu Digital Technology Co.,Ltd."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The learning history page of the Easytest is vulnerable by permission bypass. After obtaining a user\u2019s permission, remote attackers can access other users\u2019 and administrator\u2019s account information except password by crafting URL parameters."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-285 Improper Authorization"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.twcert.org.tw/tw/cp-132-5205-1de5a-1.html",
              "refsource": "MISC",
              "url": "https://www.twcert.org.tw/tw/cp-132-5205-1de5a-1.html"
            }
          ]
        },
        "solution": [
          {
            "lang": "en",
            "value": "Update Easytest to version 2100"
          }
        ],
        "source": {
          "advisory": "TVN-202110008",
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
    "assignerShortName": "twcert",
    "cveId": "CVE-2021-42336",
    "datePublished": "2021-10-15T12:10:40.380Z",
    "dateReserved": "2021-10-12T00:00:00.000Z",
    "dateUpdated": "2024-09-16T16:33:19.781Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-42335 (GCVE-0-2021-42335)

Vulnerability from cvelistv5 – Published: 2021-10-15 12:10 – Updated: 2024-09-16 19:05

Title

Huachu Digital Technology Co.,Ltd. Easytest - Stored XSS

Summary

Easytest bulletin board management function of online learning platform does not filter special characters. After obtaining a user’s privilege, remote attackers can inject JavaScript and execute stored XSS attack.

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CWE

CWE-79 - Cross-site Scripting (XSS)

Assigner

twcert CNA under the mitre root

CNA scorecard B 82/100 over 98 records in the last 180 days details

References

1 reference

URL	Tags
https://www.twcert.org.tw/tw/cp-132-5206-3cd3f-1.html	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Huachu Digital Technology Co.,Ltd.	Easytest	Affected: 1705

Date Public

2021-10-15 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T03:30:38.430Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.twcert.org.tw/tw/cp-132-5206-3cd3f-1.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Easytest",
          "vendor": "Huachu Digital Technology Co.,Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "1705"
            }
          ]
        }
      ],
      "datePublic": "2021-10-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Easytest bulletin board management function of online learning platform does not filter special characters. After obtaining a user\u2019s privilege, remote attackers can inject JavaScript and execute stored XSS attack."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Cross-site Scripting (XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-10-15T12:10:38.000Z",
        "orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
        "shortName": "twcert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.twcert.org.tw/tw/cp-132-5206-3cd3f-1.html"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Update Easytest to version 2100"
        }
      ],
      "source": {
        "advisory": "TVN-202110007",
        "discovery": "EXTERNAL"
      },
      "title": "Huachu Digital Technology Co.,Ltd. Easytest - Stored XSS",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "AKA": "TWCERT/CC",
          "ASSIGNER": "cve@cert.org.tw",
          "DATE_PUBLIC": "2021-10-15T11:57:00.000Z",
          "ID": "CVE-2021-42335",
          "STATE": "PUBLIC",
          "TITLE": "Huachu Digital Technology Co.,Ltd. Easytest - Stored XSS"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Easytest",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "1705"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Huachu Digital Technology Co.,Ltd."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Easytest bulletin board management function of online learning platform does not filter special characters. After obtaining a user\u2019s privilege, remote attackers can inject JavaScript and execute stored XSS attack."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-79 Cross-site Scripting (XSS)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.twcert.org.tw/tw/cp-132-5206-3cd3f-1.html",
              "refsource": "MISC",
              "url": "https://www.twcert.org.tw/tw/cp-132-5206-3cd3f-1.html"
            }
          ]
        },
        "solution": [
          {
            "lang": "en",
            "value": "Update Easytest to version 2100"
          }
        ],
        "source": {
          "advisory": "TVN-202110007",
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
    "assignerShortName": "twcert",
    "cveId": "CVE-2021-42335",
    "datePublished": "2021-10-15T12:10:38.906Z",
    "dateReserved": "2021-10-12T00:00:00.000Z",
    "dateUpdated": "2024-09-16T19:05:14.166Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-42334 (GCVE-0-2021-42334)

Vulnerability from cvelistv5 – Published: 2021-10-15 12:10 – Updated: 2024-09-16 16:17

Title

Huachu Digital Technology Co.,Ltd. Easytest - SQL Injection-2

Summary

The Easytest contains SQL injection vulnerabilities. After obtaining a user’s privilege, remote attackers can inject SQL commands into the parameters of the elective course management page to obtain all database and administrator permissions.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-89 - SQL Injection

Assigner

twcert CNA under the mitre root

CNA scorecard B 82/100 over 98 records in the last 180 days details

References

1 reference

URL	Tags
https://www.twcert.org.tw/tw/cp-132-5204-f80ad-1.html	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Huachu Digital Technology Co.,Ltd.	Easytest	Affected: 1705

Date Public

2021-10-15 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T03:30:38.253Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.twcert.org.tw/tw/cp-132-5204-f80ad-1.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Easytest",
          "vendor": "Huachu Digital Technology Co.,Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "1705"
            }
          ]
        }
      ],
      "datePublic": "2021-10-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The Easytest contains SQL injection vulnerabilities. After obtaining a user\u2019s privilege, remote attackers can inject SQL commands into the parameters of the elective course management page to obtain all database and administrator permissions."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 SQL Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-10-15T12:10:37.000Z",
        "orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
        "shortName": "twcert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.twcert.org.tw/tw/cp-132-5204-f80ad-1.html"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Update Easytest to version 2100"
        }
      ],
      "source": {
        "advisory": "TVN-202110006",
        "discovery": "EXTERNAL"
      },
      "title": "Huachu Digital Technology Co.,Ltd. Easytest - SQL Injection-2",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "AKA": "TWCERT/CC",
          "ASSIGNER": "cve@cert.org.tw",
          "DATE_PUBLIC": "2021-10-15T11:57:00.000Z",
          "ID": "CVE-2021-42334",
          "STATE": "PUBLIC",
          "TITLE": "Huachu Digital Technology Co.,Ltd. Easytest - SQL Injection-2"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Easytest",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "1705"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Huachu Digital Technology Co.,Ltd."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Easytest contains SQL injection vulnerabilities. After obtaining a user\u2019s privilege, remote attackers can inject SQL commands into the parameters of the elective course management page to obtain all database and administrator permissions."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-89 SQL Injection"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.twcert.org.tw/tw/cp-132-5204-f80ad-1.html",
              "refsource": "MISC",
              "url": "https://www.twcert.org.tw/tw/cp-132-5204-f80ad-1.html"
            }
          ]
        },
        "solution": [
          {
            "lang": "en",
            "value": "Update Easytest to version 2100"
          }
        ],
        "source": {
          "advisory": "TVN-202110006",
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
    "assignerShortName": "twcert",
    "cveId": "CVE-2021-42334",
    "datePublished": "2021-10-15T12:10:37.398Z",
    "dateReserved": "2021-10-12T00:00:00.000Z",
    "dateUpdated": "2024-09-16T16:17:44.540Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-42333 (GCVE-0-2021-42333)

Vulnerability from cvelistv5 – Published: 2021-10-15 12:10 – Updated: 2024-09-16 23:56

Title

Huachu Digital Technology Co.,Ltd. Easytest - SQL Injection-1

Summary

The Easytest contains SQL injection vulnerabilities. After obtaining user’s privilege, remote attackers can inject SQL commands into the parameters of the learning history page to access all database and obtain administrator permissions.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-89 - SQL Injection

Assigner

twcert CNA under the mitre root

CNA scorecard B 82/100 over 98 records in the last 180 days details

References

1 reference

URL	Tags
https://www.twcert.org.tw/tw/cp-132-5203-00de8-1.html	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Huachu Digital Technology Co.,Ltd.	Easytest	Affected: 1705

Date Public

2021-10-15 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T03:30:38.290Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.twcert.org.tw/tw/cp-132-5203-00de8-1.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Easytest",
          "vendor": "Huachu Digital Technology Co.,Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "1705"
            }
          ]
        }
      ],
      "datePublic": "2021-10-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The Easytest contains SQL injection vulnerabilities. After obtaining user\u2019s privilege, remote attackers can inject SQL commands into the parameters of the learning history page to access all database and obtain administrator permissions."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 SQL Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-10-15T12:10:35.000Z",
        "orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
        "shortName": "twcert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.twcert.org.tw/tw/cp-132-5203-00de8-1.html"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Update Easytest to version 2100"
        }
      ],
      "source": {
        "advisory": "TVN-202110005",
        "discovery": "EXTERNAL"
      },
      "title": "Huachu Digital Technology Co.,Ltd. Easytest - SQL Injection-1",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "AKA": "TWCERT/CC",
          "ASSIGNER": "cve@cert.org.tw",
          "DATE_PUBLIC": "2021-10-15T11:57:00.000Z",
          "ID": "CVE-2021-42333",
          "STATE": "PUBLIC",
          "TITLE": "Huachu Digital Technology Co.,Ltd. Easytest - SQL Injection-1"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Easytest",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "1705"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Huachu Digital Technology Co.,Ltd."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Easytest contains SQL injection vulnerabilities. After obtaining user\u2019s privilege, remote attackers can inject SQL commands into the parameters of the learning history page to access all database and obtain administrator permissions."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-89 SQL Injection"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.twcert.org.tw/tw/cp-132-5203-00de8-1.html",
              "refsource": "MISC",
              "url": "https://www.twcert.org.tw/tw/cp-132-5203-00de8-1.html"
            }
          ]
        },
        "solution": [
          {
            "lang": "en",
            "value": "Update Easytest to version 2100"
          }
        ],
        "source": {
          "advisory": "TVN-202110005",
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
    "assignerShortName": "twcert",
    "cveId": "CVE-2021-42333",
    "datePublished": "2021-10-15T12:10:35.859Z",
    "dateReserved": "2021-10-12T00:00:00.000Z",
    "dateUpdated": "2024-09-16T23:56:50.380Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

20 vulnerabilities by huaju

CVE-2024-7871 (GCVE-0-2024-7871)

CVE-2024-43776 (GCVE-0-2024-43776)

CVE-2024-43775 (GCVE-0-2024-43775)

CVE-2024-43774 (GCVE-0-2024-43774)

CVE-2024-43773 (GCVE-0-2024-43773)

CVE-2024-43772 (GCVE-0-2024-43772)

CVE-2021-42336 (GCVE-0-2021-42336)

CVE-2021-42335 (GCVE-0-2021-42335)

CVE-2021-42334 (GCVE-0-2021-42334)

CVE-2021-42333 (GCVE-0-2021-42333)

CVE-2024-43776 (GCVE-0-2024-43776)

CVE-2024-43775 (GCVE-0-2024-43775)

CVE-2024-43774 (GCVE-0-2024-43774)

CVE-2024-43773 (GCVE-0-2024-43773)

CVE-2024-43772 (GCVE-0-2024-43772)

CVE-2024-7871 (GCVE-0-2024-7871)

CVE-2021-42336 (GCVE-0-2021-42336)

CVE-2021-42335 (GCVE-0-2021-42335)

CVE-2021-42334 (GCVE-0-2021-42334)

CVE-2021-42333 (GCVE-0-2021-42333)

Find a vulnerability

Search criteria ⓘ Use this form to refine search results. Full-text search supports keyword queries with ranking and filtering. You can combine vendor, product, and sources to narrow results. Enable “Apply ordering” to sort by date instead of relevance.

20 vulnerabilities by huaju

CVE-2024-7871 (GCVE-0-2024-7871)

CVE-2024-43776 (GCVE-0-2024-43776)

CVE-2024-43775 (GCVE-0-2024-43775)

CVE-2024-43774 (GCVE-0-2024-43774)

CVE-2024-43773 (GCVE-0-2024-43773)

CVE-2024-43772 (GCVE-0-2024-43772)

CVE-2021-42336 (GCVE-0-2021-42336)

CVE-2021-42335 (GCVE-0-2021-42335)

CVE-2021-42334 (GCVE-0-2021-42334)

CVE-2021-42333 (GCVE-0-2021-42333)

CVE-2024-43776 (GCVE-0-2024-43776)

CVE-2024-43775 (GCVE-0-2024-43775)

CVE-2024-43774 (GCVE-0-2024-43774)

CVE-2024-43773 (GCVE-0-2024-43773)

CVE-2024-43772 (GCVE-0-2024-43772)

CVE-2024-7871 (GCVE-0-2024-7871)

CVE-2021-42336 (GCVE-0-2021-42336)

CVE-2021-42335 (GCVE-0-2021-42335)

CVE-2021-42334 (GCVE-0-2021-42334)

CVE-2021-42333 (GCVE-0-2021-42333)

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.