CVE-2020-16104 SQL injection in Command Centre
Remote attackers with specific privileges can execute arbitrary SQL against third-party databases in Gallagher Command Centre if EDI import is configured.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-16104?
CVE-2020-16104 is a high-severity SQL injection vulnerability in Gallagher Command Centre, published on 14 Dec 2020. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
SQL Injection vulnerability in Enterprise Data Interface of Gallagher Command Centre allows a remote attacker with 'Edit Enterprise Data Interfaces' privilege to execute arbitrary SQL against a third party database if EDI is configured to import data from this database. This issue affects: Gallagher Command Centre 8.30 versions prior to 8.30.1236(MR1); 8.20 versions prior to 8.20.1166(MR3); 8.10 versions prior to 8.10.1211(MR5); 8.00 versions prior to 8.00.1228(MR6); version 7.90 and prior versions.
Weakness: CWE-89
Which versions are affected by CVE-2020-16104?
It affects 1 product.
Products include Gallagher Command Centre.
How do I fix CVE-2020-16104?
No fix has been published for CVE-2020-16104 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2020-16104 being exploited?
There is no known exploitation of CVE-2020-16104 in the wild and no public exploit code.
Other vulnerabilities in Gallagher Command Centre
Sources
Also known as GHSA-w3xv-vqgp-pqp7.