CVE-2024-43776

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

SQL Injection in mock exam function of Easytest Online Test Platform ver.24E01 and earlier allow remote authenticated users to execute arbitrary SQL commands via the qlevel parameter.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
Huachu Digital Technology Ltd.	Easytest Online Test Platform	<= ver.24E01
huaju	easytest_online_learning_test_platform	<= 24e01

References

https://zuso.ai/advisory/za-2024-09Third Party Advisory

Timeline

Published: Sep 2, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-437788.8OS command injection vulnerability in multiple digital video recorders provided by TAKENAKA ENGINEERING CO., LTD. allows a remote authentica CVE-2024-437796.5An information disclosure vulnerability exists in the Vault API functionality of ClearML Enterprise Server 3.22.5-1533. A specially crafted CVE-2024-43785.4The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's menu and shape widgets i CVE-2024-437804.3Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.0, 9.8.x <= 9.8.2 fail to enforce permissions which allows a guest user with read a CVE-2024-437815.5A vulnerability has been identified in SINUMERIK 828D V4 (All versions < V4.95 SP3), SINUMERIK 840D sl V4 (All versions < V4.95 SP3 in conne CVE-2024-437829.8This openedx-translations repository contains translation files from Open edX repositories to be kept in sync with Transifex. Before moving CVE-2024-437837.5The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Feder CVE-2024-437845.7lakeFS is an open-source tool that transforms object storage into a Git-like repository. Existing lakeFS users who have issued credentials t CVE-2024-437852.5gitoxide An idiomatic, lean, fast & safe pure Rust implementation of Git. gitoxide-core, which provides most underlying functionality of the CVE-2024-437875.0Hono is a Web application framework that provides support for any JavaScript runtime. Hono CSRF middleware can be bypassed using crafted Con CVE-2024-437886.1Webpack is a module bundler. Its main purpose is to bundle JavaScript files for usage in a browser, yet it is also capable of transforming, CVE-2024-437894.3Discourse is an open source platform for community discussion. A user can create a post with many replies, and then attempt to fetch them al