CVE-2024-1012 in ezOFFICE
Summary
by MITRE • 01/31/2024
A vulnerability, which was classified as critical, has been found in Wanhu ezOFFICE 11.1.0. This issue affects some unknown processing of the file defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp. The manipulation of the argument recordId leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-252281 was assigned to this vulnerability.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 06/14/2025
This critical vulnerability in Wanhu ezOFFICE version 11.1.0 represents a significant security risk that allows remote exploitation through SQL injection attacks. The flaw exists within the file defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp which processes user input without proper sanitization. The vulnerability specifically occurs when the recordId parameter is manipulated, enabling attackers to inject malicious SQL commands directly into the database query execution path. This type of vulnerability falls under CWE-89 which categorizes SQL injection flaws as critical weaknesses in software applications. The remote attack vector means that malicious actors can exploit this vulnerability from outside the network without requiring local system access or authentication credentials, making it particularly dangerous for enterprise environments where such applications are publicly accessible.
The operational impact of this vulnerability extends beyond simple data theft or corruption. Attackers can leverage this SQL injection flaw to execute arbitrary database commands, potentially gaining unauthorized access to sensitive business information, user credentials, or confidential workflow data. The vulnerability's classification as critical indicates that it can be exploited without user interaction and can result in complete system compromise. The disclosed exploit in VDB-252281 suggests that threat actors have already developed working tools to take advantage of this weakness, increasing the likelihood of real-world attacks. Organizations running this version of ezOFFICE face immediate risk of data breaches, system infiltration, and potential regulatory compliance violations given the sensitive nature of business process management systems.
Mitigation strategies should focus on immediate patching and implementation of input validation controls. Organizations must urgently update to the latest version of Wanhu ezOFFICE that addresses this vulnerability, as recommended by the vendor's security advisories. Network segmentation and web application firewalls should be deployed to monitor and filter suspicious SQL injection attempts targeting this specific endpoint. Input validation must be implemented at the application level to sanitize all user-supplied parameters including recordId, preventing malicious SQL payloads from reaching the database layer. Additionally, database access controls should be reviewed and restricted to minimize potential damage from successful exploitation attempts. This vulnerability aligns with ATT&CK technique T1190 which describes the use of SQL injection to gain access to databases, and T1071.004 which covers application layer protocols including web services. Regular security assessments and penetration testing should be conducted to identify similar vulnerabilities in other enterprise applications and ensure comprehensive protection against similar attack vectors.