PT-2021-10874 · Dconnect · Connect

Published 2021-07-21 · Updated 2021-07-30 · CVE-2020-23282

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions mConnect application version v02.001.00

Description The issue allows an attacker to use a non-existing user with a generic password to connect to the application and gain access to unauthorized information through SQL injection in the Logon Page.

Recommendations For version v02.001.00, consider restricting access to the Logon Page until a fix is available, and avoid using generic passwords to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2020-23282

Affected Products

Connect

References · 5

• 🔥 https://github.com/ifmacedo/mconnect/blob/main/SQLinjection · Exploit
• https://osv.dev/vulnerability/CVE-2020-23282 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-23282 · Security Note
• https://t.me/cibsecurity/26321 · Telegram Post
• https://linkedin.com/pulse/mconnect-mv-sql-injection-parcial-iran · Note