PT-2020-10330 · Mfscripts · Mfscripts Yetishare

Published 2020-02-10 · Updated 2020-02-11 · CVE-2019-20059

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MFScripts YetiShare versions 3.5.2 through 4.5.4

Description The issue allows an attacker to inject their own SQL and manipulate the query, typically extracting data from the database, due to the direct insertion of values from the sSortDir 0 parameter into a SQL string in files such as payment manage.ajax.php and various * manage.ajax.php. This is a result of an incomplete fix for a previous issue.

Recommendations For versions 3.5.2 through 4.5.4, consider restricting access to the vulnerable * manage.ajax.php files, such as payment manage.ajax.php, until a proper fix is applied. As a temporary workaround, avoid using the sSortDir 0 parameter in the affected API endpoints to minimize the risk of exploitation.

Exploit

Fix

SQL injection

CSRF

Weakness Enumeration

CWE-89

CWE-352

Related Identifiers

CVE-2019-20059

Affected Products

Mfscripts Yetishare

References · 7

• 🔥❌ https://github.com/jra89/CVE-2019-20059 · Exploit, Deleted
• 🔥 https://medium.com/@jra8908/yetishare-3-5-2-4-5-4-multiple-vulnerabilities-927d17b71ad · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-20059 · Security Note
• https://osv.dev/vulnerability/CVE-2019-20059 · Vendor Advisory
• https://yetishare.com · Note
• https://mfscripts.com · Note
• https://medium.com/%40jra8908/yetishare-3-5-2-4-5-4-multiple-vulnerabilities-927d17b71ad · Note