CVE-2020-13591 - An exploitable SQL injection vulnerability exists in the "access_rules/rules_form" page of the Rukovoditel Project Management App 2.7.2

Back Back to CVE browser

HIGH

An exploitable SQL injection vulnerability exists in the "access_rules/rules_form" page of the Rukovoditel Project Management App 2.7.2

Published Apr 9, 2021

8.8

HIGH

CVSS 3.1

EPSS 1.51%

Description

An exploitable SQL injection vulnerability exists in the "access_rules/rules_form" page of the Rukovoditel Project Management App 2.7.2. A specially crafted HTTP request can lead to SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability, this can be done either with administrator credentials or through cross-site request forgery.

Affected products

Vendor n/a Product Rukovoditel Default
n/a
- Version
  Rukovoditel Project Management App 2.7.2
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Rukovoditel

n/a

Version	Status	Constraints
Rukovoditel Project Management App 2.7.2	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-89

SQL Injection

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-5838
Advisory
https://talosintelligence.com/vulnerability_reports/TALOS-2020-1200
x_refsource_MISCExploitThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-5838		Advisory
https://talosintelligence.com/vulnerability_reports/TALOS-2020-1200		x_refsource_MISCExploitThird Party Advisory