CVE-2020-35276

Опубликовано: 21 дек. 2020

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Низкий

Описание

EgavilanMedia ECM Address Book 1.0 is affected by SQL injection. An attacker can bypass the Admin Login panel through SQLi and get Admin access and add or remove any user.

Ссылки

http://ecm.com
Not Applicable
http://egavilanmedia.com
Product
https://hardik-solanki.medium.com/authentication-admin-panel-bypass-which-leads-to-full-admin-access-control-c10ec4ab4255
Exploit
Third Party Advisory
http://ecm.com
Not Applicable
http://egavilanmedia.com
Product
https://hardik-solanki.medium.com/authentication-admin-panel-bypass-which-leads-to-full-admin-access-control-c10ec4ab4255
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:egavilanmedia:ecm_address_book:1.0:*:*:*:*:*:*:*

EPSS

Процентиль: 54%

0.00316

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-89

Связанные уязвимости

GHSA-r7mj-3g43-28gm

github

больше 3 лет назад