PT-2021-10475 · Cmswing · Cmswing

Jiguangsdf · Published 2021-02-01 · Updated 2021-02-02 · CVE-2020-20295

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: CMSWing version 1.3.8

Description: An issue was found in the CMSWing project where the updateAction function does not check the detail parameter, allowing malicious parameters to execute arbitrary SQL commands.

Recommendations: For CMSWing version 1.3.8, consider disabling the updateAction function until a patch is available to prevent exploitation. Restrict access to the detail parameter in the affected function to minimize the risk of arbitrary SQL command execution. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2020-20295

Affected Products

Cmswing

References · 5

• 🔥 https://github.com/arterli/CmsWing/issues/50 · Exploit
• https://osv.dev/vulnerability/CVE-2020-20295 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-20295 · Security Note
• https://t.me/cibsecurity/22914 · Telegram Post
• https://t.me/cvenotify/9233 · Telegram Post