CVE-2020-24617

Name of the Vulnerable Software and Affected Versions: Mailtrain versions 1.24.1 and earlier

Description: The issue allows SQL Injection in the statsClickedSubscribersByColumn function in lib/models/campaigns.js via the "/campaigns/clicked/ajax" API endpoint because variable column names are not properly escaped. This could potentially lead to unauthorized access to database information.

Recommendations: For Mailtrain versions 1.24.1 and earlier, as a temporary workaround, consider restricting access to the /campaigns/clicked/ajax API endpoint until a patch is available. Additionally, avoid using variable column names in the statsClickedSubscribersByColumn function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.