PT-2021-9157 · Invigo · Invigo Automatic Device Management

Published 2021-03-25 · Updated 2021-03-27 · CVE-2020-10582

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Invigo Automatic Device Management (ADM) versions through 5.0

Description The issue allows remote attackers to execute arbitrary SQL requests, including data reading and modification, on the database through a SQL injection on the "/admin/display errors.php" script.

Recommendations For Invigo Automatic Device Management (ADM) versions through 5.0, consider restricting access to the "/admin/display errors.php" script until a patch is available. As a temporary workaround, avoid using sensitive database operations in the affected script to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2020-10582

Affected Products

Invigo Automatic Device Management

References · 4

• 🔥 https://on-x.com/sites/default/files/security_advisory_-_multiple_vulnerabilities_-_invigo_adm.pdf · Exploit
• https://osv.dev/vulnerability/CVE-2020-10582 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-10582 · Security Note
• https://t.me/cvenotify/12106 · Telegram Post