CVE-2023-4165

Deeper analysis

A SQL injection vulnerability exists in Tongda OA within the file general/system/seal_manage/iweboffice/delete_seal.php. The flaw stems from improper handling of the DELETE_STR parameter, allowing an attacker to inject arbitrary SQL statements. It was assigned CVE-2023-4165 with a CVSS 3.1 score of 5.5 and is tracked under CWE-89. The vendor was notified prior to public disclosure but did not respond, and an upgrade to version 11.10 resolves the issue.

An authenticated attacker with local network access can supply a crafted DELETE_STR value to execute malicious SQL queries. Successful exploitation can result in unauthorized data access, modification, or limited impact to confidentiality, integrity, and availability on the affected system. Public proof-of-concept code has been released, enabling straightforward reproduction by anyone with the required access level.

References indicate that upgrading the affected Tongda OA component to version 11.10 is the recommended mitigation. No other configuration changes or workarounds are described in the available advisories.

The EPSS score has reached 0.8867 with no lower baseline reported, and the public exploit disclosure increases the likelihood of attempted use against unpatched instances.