CVE-2020-15714: SQL Injection

Published Jul 28, 2020

Updated

rConfig 3.9.5 is vulnerable to SQL injection. A remote authenticated attacker could send crafted SQL statements to the devices.crud.php script using the customLocation parameter, which could allow the attacker to view, add, modify, or delete information in the back-end database.

Affected Software

1 affected component

rConfig rConfig=3.9.5

Event History

Jul 28, 2020

CVE Published

via MITRE·01:03 PM

Data Sourced

via MITRE·01:03 PM

Description

Frequently Asked Questions

What is CVE-2020-15714?

CVE-2020-15714 is a vulnerability in rConfig 3.9.5 that allows remote authenticated attackers to perform SQL injection.

How does CVE-2020-15714 affect rConfig?

CVE-2020-15714 affects rConfig 3.9.5 and allows remote authenticated attackers to send crafted SQL statements to the devices.crud.php script.

What is the severity of CVE-2020-15714?

CVE-2020-15714 has a severity rating of 8.8 (high).

How can an attacker exploit CVE-2020-15714?

An attacker can exploit CVE-2020-15714 by sending crafted SQL statements to the devices.crud.php script using the custom_Location parameter.

Is there a fix for CVE-2020-15714?

The rConfig team has released version 3.9.6, which fixes the SQL injection vulnerability (CVE-2020-15714). It is recommended to upgrade to this version.