PT-2019-10073 · Tyto · Tyto Sahi Pro

Goutham Madhwaraj · Published 2019-06-17 · Updated 2023-01-30 · CVE-2018-20469

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Tyto Sahi Pro versions prior to 8.0.1

Description: An issue was discovered in the web reports module of the software, where a parameter is vulnerable to h2 SQL injection. This allows attackers to inject SQL queries and run standard h2 system functions.

Recommendations: For versions prior to 8.0.1, update to a version that contains a fix for this issue to prevent SQL injection attacks. As a temporary workaround, consider restricting access to the web reports module until a patch is available. Avoid using vulnerable parameters in the affected module until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2018-20469

Affected Products

Tyto Sahi Pro

References · 5

• 🔥 https://exploit-db.com/exploits/47006 · Exploit
• 🔥 https://barriersec.com/2019/06/cve-2018-20469-sahi-pro · Exploit
• 🔥 http://packetstormsecurity.com/files/153331/Sahi-Pro-8.x-SQL-Injection.html · Exploit
• https://osv.dev/vulnerability/CVE-2018-20469 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-20469 · Security Note