Description
DigiWin EasyFlow .NET lacks validation for certain input parameters. An unauthenticated remote attacker can inject arbitrary SQL commands to read, modify, and delete database records.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| DigiWin | EasyFlow .NET | 5.x, 6.1.x, 6.6.x – < 6.6.16 | 6.6.16 |
References
- https://www.twcert.org.tw/tw/cp-132-7844-52dad-1.html third-party-advisory