CVE-2020-13526

Name of the Vulnerable Software and Affected Versions ProcessMaker version 3.4.11

Description A SQL injection issue exists in the handling of sort parameters. The sort parameter in the reportTables Ajax and clientSetupAjax pages is vulnerable to SQL injection. An attacker can make an authenticated HTTP request to trigger this issue.

Recommendations For ProcessMaker version 3.4.11, consider disabling the sort parameter in the reportTables Ajax and clientSetupAjax pages as a temporary workaround until a patch is available. Restrict access to these pages to minimize the risk of exploitation. Avoid using the sort parameter in affected pages until the issue is resolved.