PT-2020-14490 · We Com · We-Com Opendata Cms

Thelastvvv · Published 2020-07-05 · Updated 2020-07-09 · CVE-2020-15540

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions We-com OpenData CMS version 2.0

Description The issue allows SQL Injection via the username field on the administrator login page. This could potentially lead to unauthorized access to sensitive data.

Recommendations For We-com OpenData CMS version 2.0, consider restricting access to the administrator login page until a fix is available. As a temporary workaround, avoid using the username field in a way that could be exploited for SQL injection. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2020-15540

Affected Products

We-Com Opendata Cms

References · 5

• 🔥 https://cxsecurity.com/issue/WLB-2020060010 · Exploit
• 🔥 https://packetstormsecurity.com/files/157887/We-Com-OpenData-CMS-2.0-SQL-Injection.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-15540 · Security Note
• https://osv.dev/vulnerability/CVE-2020-15540 · Vendor Advisory
• https://t.me/cvenotify/4860 · Telegram Post