PT-2020-16264 · Websitebaker · Websitebaker

Roel Van Beurden · Published 2020-10-01 · Updated 2020-10-05 · CVE-2020-25990

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WebsiteBaker version 2.12.2

Description The issue allows SQL Injection via the display name parameter in the "/websitebaker/admin/preferences/save.php" API endpoint. This could enable an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Recommendations For version 2.12.2, avoid using the display name parameter in the "/websitebaker/admin/preferences/save.php" API endpoint until the issue is resolved. Consider restricting access to this endpoint to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2020-25990

Affected Products

Websitebaker

References · 4

• 🔥 https://exploit-db.com/exploits/48849 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-25990 · Security Note
• https://osv.dev/vulnerability/CVE-2020-25990 · Vendor Advisory
• https://websitebaker.org/pages/en/home.php · Vendor Advisory