PT-2020-2711 · Admidio · Admidio

M507 · Published 2020-04-24 · Updated 2020-05-04 · CVE-2020-11004

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Admidio versions prior to 3.3.13

Description The issue is related to incorrect neutralization of special elements used in SQL commands, allowing for SQL injection. This can enable a remote attacker to gain unauthorized access to protected information using specially crafted SQL queries. The vulnerability impacts the confidentiality of the system. An attacker can send a GET request with arbitrary SQL queries appended to the main cookie parameter and execute SQL queries without logging in.

Recommendations For versions prior to 3.3.13, update to version 3.3.13 to resolve the issue. As a temporary workaround, consider restricting access to the SQL query functionality to minimize the risk of exploitation. Avoid using the main cookie parameter in SQL queries until the issue is resolved.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2020-02787

CVE-2020-11004

GHSA-QH57-RCFF-GX54

Affected Products

Admidio

References · 8

• https://github.com/Admidio/admidio/commit/ea5d6f114b151ed11ec0ad7cb47bd729e77a874a · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-11004 · Security Note
• https://bdu.fstec.ru/vul/2020-02787 · Security Note
• https://osv.dev/vulnerability/CVE-2020-11004 · Vendor Advisory
• https://github.com/Admidio/admidio/issues/908 · Note
• https://github.com/Admidio/admidio/security/advisories/GHSA-qh57-rcff-gx54 · Note
• https://t.me/cvenotify/3211 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2020050423 · Note