« Volver al listado

CVE-2024-8327

Estado: AnalizadaAlta (8.8)—

Easy test

Online Learning and Testing Platform from HWA JIUH DIGITAL TECHNOLOGY does not properly validate a specific page parameter, allowing remote attackers with regular privilege to inject arbitrary SQL commands to read, modify, and delete database contents.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Easy Test Online Learning AND Testing Platform Project — Easy Test Online Learning AND Testing Platform

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-8327",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-8327",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-08-30T14:40:03.950143Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "twcert@cert.org.tw",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "twcert@cert.org.tw",
      "affectedData": [
        {
          "vendor": "HWA JIUH DIGITAL TECHNOLOGY",
          "product": "Easy test Online Learning and Testing Platform",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "24A01",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:hwa_jiuh_digital_technology:easy_test_online_learning_and_testing_platform:*:*:*:*:*:*:*:*"
          ],
          "vendor": "hwa_jiuh_digital_technology",
          "product": "easy_test_online_learning_and_testing_platform",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "24a01",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-08-30T03:15:04.020",
  "references": [
    {
      "url": "https://www.twcert.org.tw/en/cp-139-8032-a3d5c-2.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "twcert@cert.org.tw"
    },
    {
      "url": "https://www.twcert.org.tw/tw/cp-132-8028-360e1-1.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "twcert@cert.org.tw"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "twcert@cert.org.tw",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Easy test\n\nOnline Learning and Testing Platform from HWA JIUH DIGITAL TECHNOLOGY does not properly validate a specific page parameter, allowing remote attackers with regular privilege to inject arbitrary SQL commands to read, modify, and delete database contents."
    },
    {
      "lang": "es",
      "value": "La plataforma de pruebas y aprendizaje en línea Easy Test de HWA JIUH DIGITAL TECHNOLOGY no valida correctamente un parámetro de página específico, lo que permite a atacantes remotos con privilegios regulares inyectar comandos SQL arbitrarios para leer, modificar y eliminar el contenido de la base de datos."
    }
  ],
  "lastModified": "2026-06-17T08:22:21.977",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:easy_test_online_learning_and_testing_platform_project:easy_test_online_learning_and_testing_platform:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B02D8897-AECC-4041-9100-8054E600F91D",
              "versionEndExcluding": "24a01"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "twcert@cert.org.tw"
}