PT-2020-14454 · Re:Desk · Re:Desk

Published 2020-09-30 · Updated 2020-10-09 · CVE-2020-15487

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Re:Desk version 2.3

Description The issue concerns a blind unauthenticated SQL injection vulnerability in the getBaseCriteria() function. This vulnerability can be exploited by modifying the folder GET parameter in a crafted URL, allowing for the execution of arbitrary SQL statements. As a result, unauthenticated remote command execution is possible by updating specific database values, which are then executed by the eval() function in the CAuthManager.php file. This can lead to authorization bypass, enabling the recovery or modification of password hashes and password reset tokens, and potentially granting administrative privileges.

Recommendations For Re:Desk version 2.3, consider disabling the getBaseCriteria() function until a patch is available. Restrict access to the Ticket.php file and the CAuthManager.php file to minimize the risk of exploitation. Avoid using the folder parameter in crafted URLs until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2020-15487

Affected Products

Re:Desk

References · 4

• 🔥 https://labs.f-secure.com/advisories/redesk-v2-3-multiple-issues · Exploit
• https://re-desk.com/download-help-desk-software.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-15487 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15487 · Security Note