CVE-2016-20096

Name of the Vulnerable Software and Affected Versions Linknat VOS3000 versions prior to 2.1.2.1 Linknat VOS2009 versions prior to 2.1.2.1

Description An unauthenticated SQL injection allows remote attackers to execute arbitrary SQL commands. This is achieved by manipulating the name parameter in a POST request to the login endpoint. Attackers can inject malicious SQL through the login form and retrieve the results from a subsequent session request, enabling the extraction of plaintext credentials and other database content with DBA-level privileges.

Recommendations Update Linknat VOS3000 to a version newer than 2.1.2.0. Update Linknat VOS2009 to a version newer than 2.1.2.0. Avoid using the name parameter in the login endpoint until the software is updated.