RULE(RULE ID:338701)

Rule General Information
Release Date: 2025-02-25
Rule Name: Esafenet CDG OrganiseAjax SQL Injection Vulnerability
Severity:
CVE ID:
Rule Protection Details
Description: Esafenet Electronic Document Security Management System is an electronic document security protection software, the system uses the driver layer transparent encryption technology, through the encryption protection of electronic documents, to prevent internal employees from leaking and external personnel illegally stealing enterprise core important data assets. The incoming data is not precompiled and adequately verified at groupNameSearch parameter of the OrganiseAjax interface of Esafenet Electronic Document Security Management System, resulting in SQL injection vulnerability in the interface. Malicious attackers may obtain server information or server permissions directly through this vulnerability.
Impact: An attacker can inject arbitrary sql commands to view or change the database of the target by exploiting the vulnerability successfully.
Affected OS: Windows, Linux, Others
Reference:
Solutions
Please contact the software vendor to update the software patch.