TROYANOSYVIRUS
← Back to CVEs

CVE-2020-15487

CRITICAL
9.8

Description

Re:Desk 2.3 contains a blind unauthenticated SQL injection vulnerability in the getBaseCriteria() function in the protected/models/Ticket.php file. By modifying the folder GET parameter, it is possible to execute arbitrary SQL statements via a crafted URL. Unauthenticated remote command execution is possible by using this SQL injection to update certain database values, which are then executed by a bizRule eval() function in the yii/framework/web/auth/CAuthManager.php file. Resultant authorization bypass is also possible, by recovering or modifying password hashes and password reset tokens, allowing for administrative privileges to be obtained.

CVE Details

CVSS v3.1 Score9.8
SeverityCRITICAL
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack VectorNETWORK
ComplexityLOW
Privileges RequiredNONE
User InteractionNONE
Published9/30/2020
Last Modified11/21/2024
Sourcenvd
Honeypot Sightings0

Affected Products

re-desk:re\

Weaknesses (CWE)

CWE-89

References

https://labs.f-secure.com/advisories/redesk-v2-3-multiple-issues/(cve@mitre.org)
https://www.re-desk.com/download-help-desk-software.html(cve@mitre.org)
https://labs.f-secure.com/advisories/redesk-v2-3-multiple-issues/(af854a3a-2127-422b-91ae-364da2661108)
https://www.re-desk.com/download-help-desk-software.html(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.