PT-2021-11264 · Redcap · Redcap

Published 2021-01-12 · Updated 2021-07-01 · CVE-2020-26712

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: REDCap version 10.3.4

Description: The issue concerns a SQL injection vulnerability in the ToDoList function via the sort parameter. This vulnerability arises because the application incorporates user-submitted information into database queries without proper validation, allowing an attacker to exploit and potentially compromise all databases.

Recommendations: For REDCap version 10.3.4, as a temporary workaround, consider restricting access to the ToDoList function or validating and sanitizing the sort parameter to prevent SQL injection attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2020-26712

Affected Products

Redcap

References · 6

• 🔥 https://github.com/vuongdq54/RedCap · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-26712 · Security Note
• https://project-redcap.org · Vendor Advisory
• https://evms.edu/research/resources_services/redcap/redcap_change_log · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-26712 · Vendor Advisory
• https://t.me/cvenotify/8598 · Telegram Post