CVE-2020-12606

Name of the Vulnerable Software and Affected Versions DB Soft SGLAC versions prior to 20.05.001

Description An issue in the SGLAC web frontend allows an attacker to execute arbitrary SQL commands on the SQL Server. This can be achieved by using the xp cmdshell stored procedure through the ProcedimientoGenerico method in the SVCManejador.svc webservice.

Recommendations For versions prior to 20.05.001, update to version 20.05.001 or later to resolve the issue. As a temporary workaround, consider restricting access to the SVCManejador.svc webservice to minimize the risk of exploitation. Avoid using the xp cmdshell stored procedure in the affected SQL Server until the issue is resolved.