CVE-2024-1252 | Tongda OA 2017 up to 11.9 delete.php ASK_DUTY_ID sql injection

A vulnerability classified as critical was found in Tongda OA 2017 up to 11.9. Affected by this vulnerability is an unknown functionality of the file /general/attendance/manage/ask_duty/delete.php. The manipulation of the argument ASK_DUTY_ID leads to sql injection.

This vulnerability is known as CVE-2024-1252. The attack needs to be initiated within the local network. Furthermore, there is an exploit available.

It is recommended to upgrade the affected component.