CVE-2024-10546

Name of the Vulnerable Software and Affected Versions open-scratch Teaching 在线教学平台 versions up to 2.7

Description A critical issue was found in the URL Handler component, specifically affecting the /api/sys/ng-alain/getDictItemsByTable/ API endpoint. This issue leads to sql injection and can be initiated remotely. The exploit has been disclosed publicly.

Recommendations For versions up to 2.7, as a temporary workaround, consider restricting access to the /api/sys/ng-alain/getDictItemsByTable/ API endpoint until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.