PT-2020-19480 · Simplejobscript.Com · Sjs

Gwen001 · Published 2020-01-21 · Updated 2024-02-14 · CVE-2020-7229

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Simplejobscript.com SJS versions prior to 1.65

Description An issue was discovered in Simplejobscript.com SJS. There is unauthenticated SQL injection via the search engine, specifically through the landing location parameter in the countSearchedJobs() function, located in the lib/class.Job.php file.

Recommendations For versions prior to 1.65, update to version 1.65 or later to resolve the issue. As a temporary workaround, consider restricting access to the search engine or disabling the countSearchedJobs() function until a patch is available. Avoid using the landing location parameter in the affected search engine endpoint until the issue is resolved.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2020-7229

Affected Products

Sjs

References · 4

• https://simplejobscript.com · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-7229 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-7229 · Security Note
• https://github.com/niteosoft/simplejobscript/issues/7 · Note