PT-2020-18928 · Glacies · Glacies Icehrm

Yuri Kramarz · Published 2020-07-10 · Updated 2022-05-12 · CVE-2020-6114

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Glacies IceHRM version 26.6.0.OS

Description A SQL injection issue exists in the Admin Reports functionality. This can be triggered by a specially crafted HTTP request, allowing an attacker to cause SQL injection via an authenticated HTTP request.

Recommendations For Glacies IceHRM version 26.6.0.OS, consider restricting access to the Admin Reports functionality until a fix is available. As a temporary workaround, avoid using the vulnerable functionality to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2020-6114

Affected Products

Glacies Icehrm

References · 3

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2020-1067 · Exploit
• https://osv.dev/vulnerability/CVE-2020-6114 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-6114 · Security Note