CVE-2024-10656

Name of the Vulnerable Software and Affected Versions Tongda OA versions 2017 up to 11.9

Description A critical issue affects the processing of the file /pda/meeting/apply.php, where the manipulation of the mr id argument leads to SQL injection. The attack can be initiated remotely.

Recommendations For Tongda OA versions 2017 up to 11.9, as a temporary workaround, consider restricting access to the /pda/meeting/apply.php file until a patch is available. Avoid using the mr id argument in the affected file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.