CVE-2023-5019 Tongda OA delete.php sql injection

What is CVE-2023-5019?

CVE-2023-5019 is a medium-severity vulnerability in Tongda OA, published on 17 Sep 2023.

Official description

A vulnerability classified as critical was found in Tongda OA. This vulnerability affects unknown code of the file general/hr/manage/staff_reinstatement/delete.php. The manipulation of the argument REINSTATEMENT_ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 11.10 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-239860.

Weakness: CWE-89

Which versions are affected by CVE-2023-5019?

It affects 1 product.

Products include Tongda2000 Tongda Office Anywhere.

How do I fix CVE-2023-5019?

No fix has been published for CVE-2023-5019 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-5019 being exploited?

There is no known exploitation of CVE-2023-5019 in the wild and no public exploit code.

Other vulnerabilities in Tongda OA

• CVE-2022-23902 SQL injection in n/a Critical 9.8
• CVE-2022-24206 SQL injection in n/a Critical 9.8
• CVE-2023-5780 Tongda OA 2017 delete.php sql injection High 7.3
• CVE-2023-6276 Tongda OA 2017 delete.php sql injection Medium 6.3
• CVE-2023-6084 Tongda OA 2017 delete.php sql injection Medium 6.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-mp4f-c796-xq7h.