CVE-2020-11004: SQL Injection in Admidio
SQL Injection was discovered in Admidio before version 3.3.13. The main cookie parameter is concatenated into a SQL query without any input validation/sanitization, thus an attacker without logging in, can send a GET request with arbitrary SQL queries appended to the cookie parameter and execute SQL queries. The vulnerability impacts the confidentiality of the system. This has been patched in version 3.3.13.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2020-11004?
CVE-2020-11004 is a SQL Injection vulnerability found in Admidio before version 3.3.13.
What is the severity of CVE-2020-11004?
CVE-2020-11004 has a severity rating of 7.5 (high).
How does CVE-2020-11004 impact Admidio?
CVE-2020-11004 allows an attacker to execute arbitrary SQL queries by appending them to the cookie parameter in a GET request without logging in.
How do I fix CVE-2020-11004 in Admidio?
To fix CVE-2020-11004 in Admidio, upgrade to version 3.3.13 or higher.
What is the Common Weakness Enumeration (CWE) ID for CVE-2020-11004?
The CWE ID for CVE-2020-11004 is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).