CVE-2020-18019: SQL Injection

Published Apr 28, 2021

Updated

SQL Injection in Xinhu OA System v1.8.3 allows remote attackers to obtain sensitive information by injecting arbitrary commands into the "typeid" variable of the "createfolderAjax" function in the "modeworcAction.php" component.

Affected Software

1 affected component

Xinfu Oa System=1.8.3

Event History

Apr 28, 2021

CVE Published

via MITRE·01:23 PM

Data Sourced

via MITRE·01:23 PM

Description

Frequently Asked Questions

What is the severity of CVE-2020-18019?

CVE-2020-18019 has a medium severity level due to its potential for SQL injection leading to unauthorized access to sensitive information.

How do I fix CVE-2020-18019?

To fix CVE-2020-18019, update the Xinhu OA System to a version that does not contain the vulnerability or implement input validation to sanitize the 'typeid' variable.

What systems are affected by CVE-2020-18019?

CVE-2020-18019 specifically affects Xinhu OA System version 1.8.3.

What type of vulnerability is CVE-2020-18019?

CVE-2020-18019 is classified as an SQL Injection vulnerability.

How can attackers exploit CVE-2020-18019?

Attackers can exploit CVE-2020-18019 by injecting malicious SQL commands into the 'typeid' variable within the 'createfolderAjax' function.