PT-2020-18553 · Unknown · Paid Memberships

Kenichi Okuno · Published 2020-05-20 · Updated 2021-03-23 · CVE-2020-5579

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Paid Memberships versions prior to 2.3.3

Description The issue allows an attacker with administrator rights to execute arbitrary SQL commands via unspecified vectors. This can be exploited by sending malicious input to vulnerable parameters, potentially leading to unauthorized data access or modification. The estimated number of potentially affected devices worldwide is not specified.

Recommendations For versions prior to 2.3.3, update to version 2.3.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the database and limiting administrator rights to minimize the risk of exploitation. Avoid using unspecified vectors that may be vulnerable to SQL injection until the issue is resolved.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2020-5579

Affected Products

Paid Memberships

References · 5

• https://osv.dev/vulnerability/CVE-2020-5579 · Vendor Advisory
• https://paidmembershipspro.com/pmpro-update-2-3-3-security-release · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-5579 · Security Note
• https://jvn.jp/en/jp/JVN20248858/index.html · Note
• https://t.me/cvenotify/3929 · Telegram Post