CVE-2020-23149: SQL Injection
Published Aug 9, 2021
·Updated
The dbName parameter in ajaxDbInstall.php of rConfig 3.9.5 is unsanitized, allowing attackers to perform a SQL injection and access sensitive database information.
Affected Software
1 affected component
rConfig rConfig=3.9.5
Event History
Aug 9, 2021
CVE Published
via MITRE·10:54 PM
Data Sourced
via MITRE·10:54 PM
Description
Frequently Asked Questions
1
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2020-23149.
2
What is the severity of CVE-2020-23149?
The severity of CVE-2020-23149 is high with a CVSS score of 7.5.
3
What is the affected software for CVE-2020-23149?
The affected software for CVE-2020-23149 is rConfig 3.9.5.
4
How can an attacker exploit CVE-2020-23149?
An attacker can exploit CVE-2020-23149 by performing a SQL injection through the unsanitized dbName parameter in ajaxDbInstall.php of rConfig 3.9.5.
5
What is the CWE ID for CVE-2020-23149?
The CWE ID for CVE-2020-23149 is 89.