CVE-2018-20887

cPanel before 74.0.0 allows SQL injection during database backups (SEC-420)

published August 1, 2019

CVSS
—
EPSS
1%
Percentile
64.3
In the wild
Unconfirmed
What it is

⚠️ A sneaky SQL injection lurks in cPanel before version 74.0.0, just waiting for the right moment to strike during database backups! 🔥 Think of it like a restaurant that allows diners to alter their meal orders without checking their preferences — one wrong ingredient could spoil the whole dish! If exploited, this vulnerability could allow an attacker to manipulate the database during backup processes, potentially exposing sensitive information or corrupting data. While not actively exploited, the ability to tamper with the database can lead to serious data integrity issues.

Put simply

Think of it like a restaurant that allows diners to alter their meal orders without checking their preferences — one wrong ingredient could spoil the whole dish! This SQL injection vulnerability occurs during database backups, allowing unauthorized SQL commands to be executed, which could compromise the database's security.

What to do

If exploited, this vulnerability could allow an attacker to manipulate the database during backup processes, potentially exposing sensitive information or corrupting data. While not actively exploited, the ability to tamper with the database can lead to serious data integrity issues. Upgrade your cPanel to version 74.0.0 or later to eliminate this vulnerability. Regularly audit your backup processes and database configurations to ensure security best practices are followed. Don't forget to monitor for any unusual database activities! 🛡️ You've got this! Follow these steps and keep your systems safe and sound! ✨

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01060 · 64.3th percentile
Published
2019-08-01T13:03Z
EPSS history
Timeline
  • 01 AUG 13:03Z
    cPanel before 74.0.0 allows SQL injection during database backups (SEC-420)
    cvelistv5