PT-2021-10476 · Cmswing · Cmswing

Jiguangsdf · Published 2021-02-01 · Updated 2021-02-02 · CVE-2020-20296

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: CMSWing version 1.3.8

Description: An issue was found in the CMSWing project where the rechargeAction function does not check the balance parameter, allowing malicious parameters to execute arbitrary SQL commands.

Recommendations: For CMSWing version 1.3.8, consider disabling the rechargeAction function until a patch is available to prevent the execution of arbitrary SQL commands. Restrict access to the balance parameter in the affected function to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2020-20296

Affected Products

Cmswing

References · 4

• 🔥 https://github.com/arterli/CmsWing/issues/51 · Exploit
• https://osv.dev/vulnerability/CVE-2020-20296 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-20296 · Security Note
• https://t.me/cibsecurity/22908 · Telegram Post