CVE-2020-14972 SQL injection in n/a
Remote unauthenticated attackers can bypass authentication and execute arbitrary code via SQL injection in the login and lesson editing portals.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-14972?
CVE-2020-14972 is a critical SQL injection vulnerability in n/a, published on 22 Jun 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Multiple SQL injection vulnerabilities in Sourcecodester Pisay Online E-Learning System 1.0 allow remote unauthenticated attackers to bypass authentication and achieve Remote Code Execution (RCE) via the user_email, user_pass, and id parameters on the admin login-portal and the edit-lessons webpages.
Weakness: CWE-89
Which versions are affected by CVE-2020-14972?
It affects 1 product.
Products include Pisay Online E-Learning System Project Pisay Online E-Learning System.
How do I fix CVE-2020-14972?
No fix has been published for CVE-2020-14972 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2020-14972 being exploited?
There is no known exploitation of CVE-2020-14972 in the wild and no public exploit code.
Sources
Also known as GHSA-7339-r5wh-p5qw.