ESAFENET CDG SQL Injection Vulnerability in updateNotice.jsp

A critical SQL injection vulnerability has been identified in ESAFENET CDG version 5.6.3.154.205_20250114. The issue arises in the updateNotice.jsp file, where manipulation of the ID parameter allows for SQL injection. This vulnerability can be exploited remotely, potentially leading to unauthorized access or manipulation of the database.

Impact

Exploitation of this vulnerability allows for SQL injection, which could be used to execute arbitrary SQL commands. In the context of a Microsoft SQL Server, this could lead to remote code execution, allowing an attacker to execute commands on the server with the same privileges as the SQL Server service.