PT-2020-9781 · Unknown · Enigma Nms

Published 2020-03-19 · Updated 2020-03-23 · CVE-2019-16065

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Enigma NMS versions 65.0.0 and prior

Description A remote SQL injection issue was discovered in the web application, allowing an attacker to execute SQL commands. This can expose and compromise the web server, reveal database tables and values, and potentially execute system-based commands as the mysql user. The search pattern value of the manage hosts short.cgi script is affected.

Recommendations For Enigma NMS versions 65.0.0 and prior, consider restricting access to the manage hosts short.cgi script until a fix is available. As a temporary workaround, avoid using the search pattern value in the affected script to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2019-16065

Affected Products

Enigma Nms

References · 5

• 🔥 https://exploit-db.com/exploits/47365 · Exploit
• 🔥 https://mogozobo.com/?p=3647 · Exploit
• https://osv.dev/vulnerability/CVE-2019-16065 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-16065 · Security Note
• https://t.me/cvenotify/1902 · Telegram Post