CVE-2020-11004CWE-89

SQL Injection in Admidio

High · published April 24, 2020

CVSS v3.1
7.7
EPSS
2%
Percentile
74.3
In the wild
Unconfirmed
What it is

SQL Injection was discovered in Admidio before version 3.3.13. The main cookie parameter is concatenated into a SQL query without any input validation/sanitization, thus an attacker without logging in, can send a GET request with arbitrary SQL queries appended to the cookie parameter and execute SQL queries. The vulnerability impacts the confidentiality of the system. This has been patched in version 3.3.13.

The record
Technical detail
CVSS v3.1
7.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.01515 · 74.3th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2020-04-24T20:25Z
EPSS history
Timeline
  • 24 APR 20:25Z
    SQL Injection in Admidio
    cvelistv5