Description
The eHDR CTMS from Sunnet has a SQL Injection vulnerability, allowing remote attackers with regular privileges to inject arbitrary SQL command to read database contents.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Sunnet | eHRD CTMS | ≤ 10.13 | — |
References
- https://www.twcert.org.tw/tw/cp-132-10083-4ed7f-1.html third-party-advisory
- https://www.twcert.org.tw/en/cp-139-10084-d7c47-2.html third-party-advisory