CVE-2024-5653

Name of the Vulnerable Software and Affected Versions Chanjet Smooth T+ system version 3.5

Description A critical issue has been found in the system, affecting the processing of the file /tplus/UFAQD/keyEdit.aspx. The manipulation of the KeyID argument leads to SQL injection. The attack can be initiated remotely. The vendor was contacted about this disclosure but did not respond.

Recommendations For Chanjet Smooth T+ system version 3.5, consider disabling access to the /tplus/UFAQD/keyEdit.aspx file until a patch is available. Restrict the manipulation of the KeyID argument to minimize the risk of SQL injection. At the moment, there is no information about a newer version that contains a fix for this vulnerability.