CVE-2020-13526: SQL Injection

Published Dec 10, 2020

Updated

SQL injection vulnerability exists in the handling of sort parameters in ProcessMaker 3.4.11. A specially crafted HTTP request can cause an SQL injection. The reportTablesAjax and clientSetupAjax pages are vulnerable to SQL injection in the sort parameter.An attacker can make an authenticated HTTP request to trigger these vulnerabilities.

Affected Software

1 affected component

ProcessMaker ProcessMaker=3.4.11

Event History

Dec 10, 2020

CVE Published

via MITRE·09:15 PM

Data Sourced

via MITRE·09:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the vulnerability ID for this SQL injection vulnerability?

The vulnerability ID for this SQL injection vulnerability is CVE-2020-13526.

What is the severity of CVE-2020-13526?

The severity of CVE-2020-13526 is high with a score of 8.8.

What is the affected software version of CVE-2020-13526?

The affected software version of CVE-2020-13526 is ProcessMaker 3.4.11.

How does the SQL injection occur in ProcessMaker 3.4.11?

The SQL injection vulnerability in ProcessMaker 3.4.11 occurs in the handling of sort parameters in the reportTables_Ajax and clientSetupAjax pages.

How can I fix CVE-2020-13526?

To fix CVE-2020-13526, it is recommended to apply the latest patch or update provided by ProcessMaker.