CVE-2020-3936 Unisoon UltraLog Express - SQL Injection
Attackers can inject arbitrary SQL commands into the Unisoon UltraLog Express device management interface due to improper input filtering.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-3936?
CVE-2020-3936 is a critical SQL injection vulnerability in Unisoon UltraLog Express, published on 27 Mar 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
UltraLog Express device management interface does not properly filter user inputted string in some specific parameters, attackers can inject arbitrary SQL command.
Weakness: CWE-89
Which versions are affected by CVE-2020-3936?
It affects 1 product.
Products include Unisoon Ultralog Express Firmware.
How do I fix CVE-2020-3936?
No fix has been published for CVE-2020-3936 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2020-3936 being exploited?
There is no known exploitation of CVE-2020-3936 in the wild and no public exploit code.
Other vulnerabilities in Unisoon UltraLog Express
Sources
Also known as GHSA-chfh-m75v-856c.