CVE-2020-26712: SQL Injection
REDCap 10.3.4 contains a SQL injection vulnerability in the ToDoList function via sort parameter. The application uses the addition of a string of information from the submitted user that is not validated well in the database query, resulting in an SQL injection vulnerability where an attacker can exploit and compromise all databases.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-26712?
The severity of CVE-2020-26712 is rated as critical with a score of 9.8.
How does REDCap 10.3.4 SQL injection vulnerability CVE-2020-26712 occur?
The SQL injection vulnerability in REDCap 10.3.4 via the sort parameter happens due to inadequate validation of user-submitted data in database queries, allowing attackers to manipulate SQL commands.
What is the CWE associated with CVE-2020-26712 vulnerability?
The CWE associated with CVE-2020-26712 vulnerability is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')).
How can I mitigate the CVE-2020-26712 vulnerability in REDCap 10.3.4?
To mitigate the CVE-2020-26712 vulnerability, it is recommended to apply the latest security patches provided by the vendor and implement input validation and parameterized queries to prevent SQL injection attacks.