CVE-2024-1012 is a medium severity SQL injection flaw, scored 6.3, in Wanhu ezOFFICE 11.1.0. The public record names no fixed version. Restrict network access to the product, check your installed version against the one named in the record, and watch the vendor or project page for a patch.
What's affected
Affected: Wanhu ezOFFICE 11.1.0. The record's CVSS 3.1 score is 6.3 (medium), with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. The record names defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp and the recordId argument. The weakness is filed as CWE-89.
Fixed version: The record names no fixed version. No patched release is confirmed, so check the vendor or project page.
The record's kev flag is false, so this CVE is not in the CISA Known Exploited Vulnerabilities catalog. One thing to note: the VulDB wording in the description calls the issue critical, while the CVSS score in the record is 6.3, which is medium. Treat the numeric score and your own exposure as the guide, and know that both labels exist.
How to check if you're exposed
- Find the product in your inventory and confirm the version. Many of these small applications are installed from a source archive, so the version may live in a file or a database table and not in a package manager.
- Check which networks can reach the application, and whether it is exposed to the internet.
- Review database and web logs for malformed values in the named parameter and for database errors surfacing in responses. Check that the database account used by the application has only the privileges it needs.
- Check the vendor or project page for a release newer than the affected one.
What to do now
- Take the product off the internet if it is exposed. Put it behind a VPN or an allow list of known addresses.
- Restrict access at the network layer to the people and systems that need it.
- Watch the vendor or project page for a fixed release, and apply it when one appears. The record does not confirm any patch, so check the source directly.
- Review logs for the signs above and rotate administrator credentials if you see anything unusual.
- Add the product to your inventory and monitoring so a future fix or advisory reaches you. A free in-browser dependency scan covers the third party packages in software you build, though it does not inspect device firmware.
Why it matters
SQL injection happens when user input is placed into a database query as text and not as a parameter. The database cannot tell the developer's query from the attacker's additions, so the input can change what the query does: read other rows, bypass a login check or modify data.
The fix pattern is well known: prepared statements with bound parameters, plus input validation as a second layer. Small PHP and Java applications built from tutorials or sample code often skip both, which is why this class keeps appearing in records like this one.
Smaller commercial and sample code projects often have no security contact and no release cadence. If no fix arrives, the choices are to harden around the product or to replace it.
The record states that the exploit has been disclosed to the public. That means details are available to others, not that attacks have been observed. Only CISA KEV or a vendor advisory can say that, and neither does here.
Try it yourself
See how a code scan flags injection style patterns in source.
Click through it at your own pace, or open it full screen.
Quick check
Is this CVE exploited in the wild?
The record's kev flag is false, so it is not in the CISA Known Exploited Vulnerabilities catalog, and no source I read reports active exploitation. The record does say a public exploit exists. That is a reason to patch or contain it soon, not a report of attacks.
What if there is no patch?
Reduce exposure. Remove internet access, restrict the network, apply the log and credential checks above, and plan to replace the product if it holds sensitive data.
Sources
- Safeguard Gold entry for CVE-2024-1012, built from the NVD record
- NVD record fields: description, CVSS 3.1 vector, CWE list and CPE product data. I did not fetch the researcher write ups listed in the record, so the details above are limited to what the record states.
Last reviewed: 19 October 2026.
