CVE-2024-43772

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

SQL Injection in download student learning course function of Easytest Online Test Platform ver.24E01 and earlier allow remote attackers to execute arbitrary SQL commands via the uid parameter.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
Huachu Digital Technology Ltd.	Easytest Online Test Platform	<= ver.24E01
huaju	easytest_online_learning_test_platform	<= 24e01

References

https://zuso.ai/advisory/za-2024-05Third Party Advisory

Timeline

Published: Sep 2, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-437739.8SQL Injection in download class learning course function of Easytest Online Test Platform ver.24E01 and earlier allow remote attackers to ex CVE-2024-437748.8SQL Injection in download personal learning course function of Easytest Online Test Platform ver.24E01 and earlier allow remote authenticate CVE-2024-437758.8SQL Injection in search course titles function of Easytest Online Test Platform ver.24E01 and earlier allow remote authenticated users to ex CVE-2024-437768.8SQL Injection in mock exam function of Easytest Online Test Platform ver.24E01 and earlier allow remote authenticated users to execute arbit CVE-2024-437788.8OS command injection vulnerability in multiple digital video recorders provided by TAKENAKA ENGINEERING CO., LTD. allows a remote authentica CVE-2024-437796.5An information disclosure vulnerability exists in the Vault API functionality of ClearML Enterprise Server 3.22.5-1533. A specially crafted CVE-2024-43785.4The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's menu and shape widgets i CVE-2024-437804.3Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.0, 9.8.x <= 9.8.2 fail to enforce permissions which allows a guest user with read a CVE-2024-437815.5A vulnerability has been identified in SINUMERIK 828D V4 (All versions < V4.95 SP3), SINUMERIK 840D sl V4 (All versions < V4.95 SP3 in conne CVE-2024-437829.8This openedx-translations repository contains translation files from Open edX repositories to be kept in sync with Transifex. Before moving CVE-2024-437837.5The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Feder CVE-2024-437845.7lakeFS is an open-source tool that transforms object storage into a Git-like repository. Existing lakeFS users who have issued credentials t