CVE-2020-37242

Name of the Vulnerable Software and Affected Versions Supsystic Ultimate Maps version 1.1.12

Description An SQL injection flaw allows unauthenticated attackers to execute arbitrary SQL queries. This is achieved by injecting malicious code through the sidx GET parameter when interacting with the getListForTbl action. Attackers can utilize boolean-based blind or time-based blind SQL injection—techniques used to infer data from a database by observing the server's response or the time it takes to respond—to extract sensitive database information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the sidx parameter in the getListForTbl action until the issue is resolved.