【Vulnerability Alert】Taiwan Secom Dr.ID Access Control System - SQL Injection
publish date :
2024-09-02
update date :
2024-09-02
Source: Ministry of education information & communication security contingency platform
| Publication Number | TACERT-ANA-2024081608083939 | Publication Time | 2024/08/16 08:43 |
| Incident Type | ANA-Vulnerability Alert | Discovery Time | 2024/08/15 17:58 |
| Impact Level | Medium | ||
| [Subject] 【Vulnerability Alert】Taiwan Secom Dr.ID Access Control System - SQL Injection |
|||
| [Content] Forwarded from TWCERTCC-200-202408-00000003 TWCERT/CC issued TVN-202408005 on 2024-08-13, identifying CVE-2024-7731 (CVSS:9.8 Critical) in the Taiwan Secom Dr.ID Access Control System. The vulnerability is due to improper validation of specific page parameters, which allows unauthenticated remote attackers to inject SQL commands, enabling them to read, modify, and delete database content. Information Sharing Level: WHITE (Information content can be publicly disclosed) |
|||
| [Affected Platform] ● Dr.ID Access Control System versions prior to 3.6.3 (exclusive) |
|||
| [Recommended Actions] Update the Dr.ID Access Control System to version 3.6.3 or later. |
|||
| [Reference] |
|||
(This notification is for informational purposes only and does not constitute a cybersecurity incident).
If you have questions or suggestions regarding this notification, please feel free to contact us.
Ministry of education information & communication security contingency platform
Website: https://info.cert.tanet.edu.tw/
Phone: +886-7-5250211
Internet Phone: 98400000
E-Mail: service@cert.tanet.edu.tw
If you have questions or suggestions regarding this notification, please feel free to contact us.
Ministry of education information & communication security contingency platform
Website: https://info.cert.tanet.edu.tw/
Phone: +886-7-5250211
Internet Phone: 98400000
E-Mail: service@cert.tanet.edu.tw
Organizer:
Computer Center