PT-2020-13307 · Rainbowfish · Rainbowfish Pacsone Server

Published 2020-09-30 · Updated 2020-10-02 · CVE-2020-12870

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions RainbowFish PacsOne Server version 6.8.4

Description The issue allows SQL injection on the username parameter in the "signup page" API endpoint.

Recommendations For RainbowFish PacsOne Server version 6.8.4, avoid using the username parameter in the signup page until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2020-12870

Affected Products

Rainbowfish Pacsone Server

References · 4

• 🔥 https://github.com/bzyo/cve-pocs/tree/master/CVE-2020-12870 · Exploit
• https://osv.dev/vulnerability/CVE-2020-12870 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-12870 · Security Note
• https://pacsone.net/download.htm · Vendor Advisory