CVE-2020-15849 SQL injection in n/a
An authenticated admin can exploit SQL injection to read sensitive data, modify password tokens, and execute arbitrary PHP code via framework features.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-15849?
CVE-2020-15849 is a high-severity SQL injection vulnerability in n/a, published on 30 Sep 2020. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Re:Desk 2.3 has a blind authenticated SQL injection vulnerability in the SettingsController class, in the actionEmailTemplates() method. A malicious actor with access to an administrative account could abuse this vulnerability to recover sensitive data from the application's database, allowing for authorization bypass and taking over additional accounts by means of modifying password-reset tokens stored in the database. Remote command execution is also possible by leveraging this to abuse the Yii framework's bizRule functionality, allowing for arbitrary PHP code to be executed by the application. Remote command execution is also possible by using this together with a separate insecure file upload vulnerability (CVE-2020-15488).
Weakness: CWE-89
Which versions are affected by CVE-2020-15849?
It affects 1 product.
Products include Re-Desk Re\.
How do I fix CVE-2020-15849?
No fix has been published for CVE-2020-15849 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2020-15849 being exploited?
There is no known exploitation of CVE-2020-15849 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-2wmr-35cq-3r7p.