PT-2021-10843

CVE-2020-23149

·

Published

2021-08-09

·

Updated

2021-08-12

Description by

CVSS 3.1
7.5
High
MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions rConfig version 3.9.5
Description The issue allows attackers to perform a SQL injection and access sensitive database information due to the unsanitized dbName parameter in the ajaxDbInstall.php file.
Recommendations For rConfig version 3.9.5, consider sanitizing the dbName parameter in the ajaxDbInstall.php file to prevent SQL injection attacks. As a temporary workaround, restrict access to the ajaxDbInstall.php file until a patch is available.
Exploitability
Exploit
Fix
Impacts
Vendors
Affected products
Weakness enumeration
CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')
Related identifiers
CVE-2020-23149
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com