CVE-2023-4165

MEDIUM

Tongda OA - SQL Injection via DELETE_STR Parameter in delete_seal.php

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2023-4165. PoCs published by mvpyyds.

AI-analyzed exploit summary This repository contains a Python script that scans for CVE-2023-4165, a SQL injection vulnerability in Tongda OA. The script sends a crafted HTTP request with a time-based SQL injection payload to detect the vulnerability.

Description

A vulnerability, which was classified as critical, was found in Tongda OA. This affects an unknown part of the file general/system/seal_manage/iweboffice/delete_seal.php. The manipulation of the argument DELETE_STR leads to sql injection. The exploit has been disclosed to the public and may be used. Upgrading to version 11.10 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-236181 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Exploits (1)

nomisec SCANNER
by mvpyyds · poc
https://github.com/mvpyyds/CVE-2023-4165

This repository contains a Python script that scans for CVE-2023-4165, a SQL injection vulnerability in Tongda OA. The script sends a crafted HTTP request with a time-based SQL injection payload to detect the vulnerability.

Classification
Scanner 90%
Attack Type
Sqli
Complexity
Trivial
Reliability
Reliable
Target: Tongda OA
No auth needed
Prerequisites: Network access to the target Tongda OA instance
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (3)

Core 3
Core References
Permissions Required, Third Party Advisory vdb-entry technical-description
https://vuldb.com/?id.236181
Permissions Required, Third Party Advisory signature permissions-required
https://vuldb.com/?ctiid.236181

Scores

CVSS v3 5.5
EPSS 0.1085
EPSS Percentile 95.3%
Attack Vector ADJACENT_NETWORK
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-89
Status published
Products (1)
tongda2000/tongda_office_anywhere 11.10
Published Aug 05, 2023
Tracked Since Feb 18, 2026