go to Content
:::

TWCERT/CC Taiwan Computer Emergency Response Team/Coordination Center

:::
Date:
Font-stze:

ChanGate EnterPrise Co., Ltd property management system - SQL Injection

TVN ID TVN-202101010
CVE ID CVE-2021-22856
CVSS 9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products CGE property management system version 1.00
Description The CGE property management system contains SQL Injection vulnerabilities. Remote attackers can inject SQL commands into the parameters in Cookie and obtain data in the database without privilege.
Solution Update CGE property management system to the latest version.
Credit Jia-Rong Chen
Public Date 2021-02-17

Links

  1. CVE-2021-22856
  2. CHT Security Red Team Discovered Several Vulnerabilities in Well-Known Property Management System
Top