CVE-2020-16629: SQL Injection

Published Feb 8, 2021

Updated

PhpOK 5.4.137 contains a SQL injection vulnerability that can inject an attachment data through SQL, and then call the attachment replacement function through api.php to write a PHP file to the target path.

Affected Software

1 affected component

PhpOK PhpOK=5.4.137

Event History

Feb 8, 2021

CVE Published

via MITRE·02:33 PM

Data Sourced

via MITRE·02:33 PM

Description

Frequently Asked Questions

What is the severity of CVE-2020-16629?

CVE-2020-16629 is classified as a high severity vulnerability due to its potential for exploitation through SQL injection leading to remote code execution.

How do I fix CVE-2020-16629?

To fix CVE-2020-16629, upgrade to the latest version of PhpOK that addresses this SQL injection vulnerability.

What types of attacks can CVE-2020-16629 facilitate?

CVE-2020-16629 can facilitate attacks such as unauthorized file creation and remote code execution on the affected server.

Which version of PhpOK is affected by CVE-2020-16629?

CVE-2020-16629 affects PhpOK version 5.4.137 specifically.

What are the potential impacts of exploiting CVE-2020-16629?

Exploiting CVE-2020-16629 can lead to the compromise of the server, data leakage, and full control of the affected web application.