CVE-2020-12870 SQL injection in n/a
An attacker can perform SQL injection via the username parameter on the signup page of RainbowFish PacsOne Server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-12870?
CVE-2020-12870 is a critical SQL injection vulnerability in n/a, published on 30 Sep 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
RainbowFish PacsOne Server 6.8.4 allows SQL injection on the username parameter in the signup page.
Weakness: CWE-89
Which versions are affected by CVE-2020-12870?
It affects 1 product.
Products include Rainbowfishsoftware Pacsone Server.
How do I fix CVE-2020-12870?
No fix has been published for CVE-2020-12870 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2020-12870 being exploited?
There is no known exploitation of CVE-2020-12870 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2020-29165 PacsOne Server (PACS Server In One Box) below 7.1.1 is affected by incorrect access control, which can result in remotely gaining administrator privileges.
- CVE-2020-29163 SQL injection in n/a
- CVE-2020-12715 File upload in n/a
- CVE-2020-29166 Path traversal in n/a
- CVE-2020-29164 Cross-site scripting in n/a
Sources
Also known as GHSA-2f4q-74mc-vp6m.