PT-2020-14718 · Mida · Mida Eframework

Andrea Baesso · Published 2020-07-24 · Updated 2020-07-27 · CVE-2020-15924

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mida eFramework versions prior to 2.9.1

Description The issue is related to a SQL Injection that leads to Information Disclosure. No authentication is required to exploit this issue. The injection point is located in one of the authentication parameters, specifically in the authentication parameters.

Recommendations For versions prior to 2.9.1, update to version 2.9.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the authentication parameters to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2020-15924

Affected Products

Mida Eframework

References · 3

• 🔥 https://elbae.github.io/jekyll/update/2020/07/14/vulns-01.html · Exploit
• https://osv.dev/vulnerability/CVE-2020-15924 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15924 · Security Note