CVE-2024-8327 (GCVE-0-2024-8327)

Vulnerability from cvelistv5 – Published: 2024-08-30 02:14 – Updated: 2024-08-30 14:43
VLAI
Title
HWA JIUH DIGITAL TECHNOLOGY Easy test Online Learning and Testing Platform - SQL injection
Summary
Easy test Online Learning and Testing Platform from HWA JIUH DIGITAL TECHNOLOGY does not properly validate a specific page parameter, allowing remote attackers with regular privilege to inject arbitrary SQL commands to read, modify, and delete database contents.
Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
  • CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
Impacted products
Vendor Product Version
HWA JIUH DIGITAL TECHNOLOGY Easy test Online Learning and Testing Platform Affected: 0 , < 24A01 (custom)
Create a notification for this product.
hwa_jiuh_digital_technology easy_test_online_learning_and_testing_platform Affected: 0 , < 24a01 (custom)
    cpe:2.3:a:hwa_jiuh_digital_technology:easy_test_online_learning_and_testing_platform:*:*:*:*:*:*:*:*
 Create a notification for this product.
Date Public
2024-08-30 02:14
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:hwa_jiuh_digital_technology:easy_test_online_learning_and_testing_platform:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "easy_test_online_learning_and_testing_platform",
            "vendor": "hwa_jiuh_digital_technology",
            "versions": [
              {
                "lessThan": "24a01",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-8327",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-30T14:40:03.950143Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-30T14:43:49.035Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Easy test Online Learning and Testing Platform",
          "vendor": "HWA JIUH DIGITAL TECHNOLOGY",
          "versions": [
            {
              "lessThan": "24A01",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2024-08-30T02:14:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eEasy test\u003c/span\u003e\n\nOnline Learning and Testing Platform from\u0026nbsp;HWA JIUH DIGITAL TECHNOLOGY does not properly validate a specific page parameter, allowing remote attackers with regular privilege to inject arbitrary SQL commands to read, modify, and delete database contents."
            }
          ],
          "value": "Easy test\n\nOnline Learning and Testing Platform from\u00a0HWA JIUH DIGITAL TECHNOLOGY does not properly validate a specific page parameter, allowing remote attackers with regular privilege to inject arbitrary SQL commands to read, modify, and delete database contents."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-66",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-66 SQL Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-08-30T02:14:15.684Z",
        "orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
        "shortName": "twcert"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.twcert.org.tw/tw/cp-132-8028-360e1-1.html"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.twcert.org.tw/en/cp-139-8032-a3d5c-2.html"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update to version 24A01 or later."
            }
          ],
          "value": "Update to version 24A01 or later."
        }
      ],
      "source": {
        "advisory": "TVN-202408007",
        "discovery": "EXTERNAL"
      },
      "title": "HWA JIUH DIGITAL TECHNOLOGY Easy test Online Learning and Testing Platform - SQL injection",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
    "assignerShortName": "twcert",
    "cveId": "CVE-2024-8327",
    "datePublished": "2024-08-30T02:14:15.684Z",
    "dateReserved": "2024-08-30T01:25:02.912Z",
    "dateUpdated": "2024-08-30T14:43:49.035Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-8327",
      "date": "2026-06-29",
      "epss": "0.00671",
      "percentile": "0.47366"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:easy_test_online_learning_and_testing_platform_project:easy_test_online_learning_and_testing_platform:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"24a01\", \"matchCriteriaId\": \"B02D8897-AECC-4041-9100-8054E600F91D\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Easy test\\n\\nOnline Learning and Testing Platform from\\u00a0HWA JIUH DIGITAL TECHNOLOGY does not properly validate a specific page parameter, allowing remote attackers with regular privilege to inject arbitrary SQL commands to read, modify, and delete database contents.\"}, {\"lang\": \"es\", \"value\": \"La plataforma de pruebas y aprendizaje en l\\u00ednea Easy Test de HWA JIUH DIGITAL TECHNOLOGY no valida correctamente un par\\u00e1metro de p\\u00e1gina espec\\u00edfico, lo que permite a atacantes remotos con privilegios regulares inyectar comandos SQL arbitrarios para leer, modificar y eliminar el contenido de la base de datos.\"}]",
      "id": "CVE-2024-8327",
      "lastModified": "2024-09-04T17:11:23.533",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"twcert@cert.org.tw\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 8.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 5.9}]}",
      "published": "2024-08-30T03:15:04.020",
      "references": "[{\"url\": \"https://www.twcert.org.tw/en/cp-139-8032-a3d5c-2.html\", \"source\": \"twcert@cert.org.tw\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://www.twcert.org.tw/tw/cp-132-8028-360e1-1.html\", \"source\": \"twcert@cert.org.tw\", \"tags\": [\"Vendor Advisory\"]}]",
      "sourceIdentifier": "twcert@cert.org.tw",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"twcert@cert.org.tw\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-89\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-8327\",\"sourceIdentifier\":\"twcert@cert.org.tw\",\"published\":\"2024-08-30T03:15:04.020\",\"lastModified\":\"2026-06-17T08:22:21.977\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Easy test\\n\\nOnline Learning and Testing Platform from\u00a0HWA JIUH DIGITAL TECHNOLOGY does not properly validate a specific page parameter, allowing remote attackers with regular privilege to inject arbitrary SQL commands to read, modify, and delete database contents.\"},{\"lang\":\"es\",\"value\":\"La plataforma de pruebas y aprendizaje en l\u00ednea Easy Test de HWA JIUH DIGITAL TECHNOLOGY no valida correctamente un par\u00e1metro de p\u00e1gina espec\u00edfico, lo que permite a atacantes remotos con privilegios regulares inyectar comandos SQL arbitrarios para leer, modificar y eliminar el contenido de la base de datos.\"}],\"affected\":[{\"source\":\"twcert@cert.org.tw\",\"affectedData\":[{\"vendor\":\"HWA JIUH DIGITAL TECHNOLOGY\",\"product\":\"Easy test Online Learning and Testing Platform\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"24A01\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"affectedData\":[{\"vendor\":\"hwa_jiuh_digital_technology\",\"product\":\"easy_test_online_learning_and_testing_platform\",\"defaultStatus\":\"unknown\",\"cpes\":[\"cpe:2.3:a:hwa_jiuh_digital_technology:easy_test_online_learning_and_testing_platform:*:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"0\",\"lessThan\":\"24a01\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"twcert@cert.org.tw\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-08-30T14:40:03.950143Z\",\"id\":\"CVE-2024-8327\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"twcert@cert.org.tw\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-89\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:easy_test_online_learning_and_testing_platform_project:easy_test_online_learning_and_testing_platform:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"24a01\",\"matchCriteriaId\":\"B02D8897-AECC-4041-9100-8054E600F91D\"}]}]}],\"references\":[{\"url\":\"https://www.twcert.org.tw/en/cp-139-8032-a3d5c-2.html\",\"source\":\"twcert@cert.org.tw\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://www.twcert.org.tw/tw/cp-132-8028-360e1-1.html\",\"source\":\"twcert@cert.org.tw\",\"tags\":[\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-8327\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-08-30T14:40:03.950143Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:hwa_jiuh_digital_technology:easy_test_online_learning_and_testing_platform:*:*:*:*:*:*:*:*\"], \"vendor\": \"hwa_jiuh_digital_technology\", \"product\": \"easy_test_online_learning_and_testing_platform\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"24a01\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-08-30T14:43:42.605Z\"}}], \"cna\": {\"title\": \"HWA JIUH DIGITAL TECHNOLOGY Easy test Online Learning and Testing Platform - SQL injection\", \"source\": {\"advisory\": \"TVN-202408007\", \"discovery\": \"EXTERNAL\"}, \"impacts\": [{\"capecId\": \"CAPEC-66\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-66 SQL Injection\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 8.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"HWA JIUH DIGITAL TECHNOLOGY\", \"product\": \"Easy test Online Learning and Testing Platform\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"24A01\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"Update to version 24A01 or later.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Update to version 24A01 or later.\", \"base64\": false}]}], \"datePublic\": \"2024-08-30T02:14:00.000Z\", \"references\": [{\"url\": \"https://www.twcert.org.tw/tw/cp-132-8028-360e1-1.html\", \"tags\": [\"third-party-advisory\"]}, {\"url\": \"https://www.twcert.org.tw/en/cp-139-8032-a3d5c-2.html\", \"tags\": [\"third-party-advisory\"]}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Easy test\\n\\nOnline Learning and Testing Platform from\\u00a0HWA JIUH DIGITAL TECHNOLOGY does not properly validate a specific page parameter, allowing remote attackers with regular privilege to inject arbitrary SQL commands to read, modify, and delete database contents.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003eEasy test\u003c/span\u003e\\n\\nOnline Learning and Testing Platform from\u0026nbsp;HWA JIUH DIGITAL TECHNOLOGY does not properly validate a specific page parameter, allowing remote attackers with regular privilege to inject arbitrary SQL commands to read, modify, and delete database contents.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-89\", \"description\": \"CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e\", \"shortName\": \"twcert\", \"dateUpdated\": \"2024-08-30T02:14:15.684Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-8327\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-08-30T14:43:49.035Z\", \"dateReserved\": \"2024-08-30T01:25:02.912Z\", \"assignerOrgId\": \"cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e\", \"datePublished\": \"2024-08-30T02:14:15.684Z\", \"assignerShortName\": \"twcert\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.