PT-2020-13603 · Processmaker · Processmaker

Yuri Kramarz · Published 2020-12-10 · Updated 2023-11-06 · CVE-2020-13526

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ProcessMaker version 3.4.11

Description A SQL injection issue exists in the handling of sort parameters. The sort parameter in the reportTables Ajax and clientSetupAjax pages is vulnerable to SQL injection. An attacker can make an authenticated HTTP request to trigger this issue.

Recommendations For ProcessMaker version 3.4.11, consider disabling the sort parameter in the reportTables Ajax and clientSetupAjax pages as a temporary workaround until a patch is available. Restrict access to these pages to minimize the risk of exploitation. Avoid using the sort parameter in affected pages until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BIT-PROCESSMAKER-2020-13526

CVE-2020-13526

Affected Products

Processmaker

References · 12

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2020-1126 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-13526 · Security Note
• https://osv.dev/vulnerability/BIT-processmaker-2020-13526 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-13526 · Vendor Advisory
• https://t.me/cibsecurity/19636 · Telegram Post
• https://t.me/cibsecurity/19656 · Telegram Post
• https://t.me/cibsecurity/19676 · Telegram Post
• https://t.me/cibsecurity/19696 · Telegram Post
• https://t.me/cibsecurity/19736 · Telegram Post
• https://t.me/cibsecurity/19756 · Telegram Post
• https://t.me/cvenotify/7014 · Telegram Post
• https://t.me/cibsecurity/19716 · Telegram Post