CVE-2017-10936

SQL injection vulnerability in all versions prior to V4.01.01 of the ZTE ZXCDN-SNS product allows remote attackers to execute arbitrary SQL commands via the aoData parameter, resulting in the disclosure of database information.

Score

CVSS 3.0 7.5 High

Status

Modified - psirt@zte.com.cn

Published

2018-07-25

Last modified

2024-09-17

Weaknesses

CWE-89

Affected products

• Zxcdn-sns (Zte)
• Zxcdn-sns Firmware (Zte)

References

• http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1008722