PT-2020-13165
CVE-2020-12606
·
تاريخ النشر
2020-08-17
·
تاريخ التحديث
2020-08-21
الوصف من
CVSS 3.1
9.8
حرجةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
DB Soft SGLAC versions prior to 20.05.001
Description
An issue in the SGLAC web frontend allows an attacker to execute arbitrary SQL commands on the SQL Server. This can be achieved by using the
xp cmdshell stored procedure through the ProcedimientoGenerico method in the SVCManejador.svc webservice.Recommendations
For versions prior to 20.05.001, update to version 20.05.001 or later to resolve the issue. As a temporary workaround, consider restricting access to the
SVCManejador.svc webservice to minimize the risk of exploitation. Avoid using the xp cmdshell stored procedure in the affected SQL Server until the issue is resolved.قابلية الاستغلال
استغلال
إصلاح
التأثيرات
الباحثون
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾