CVE-2020-18019 - SQL Injection in Xinhu OA System v1.8.3 allows remote attackers to obtain sensitive information by injecting arbitrary commands into the "typeid" variable of the "createfolderAjax" function in the "mode_worcAction.php" component

Back Back to CVE browser

HIGH

SQL Injection in Xinhu OA System v1.8.3 allows remote attackers to obtain sensitive information by injecting arbitrary commands into the "typeid" variable of the "createfolderAjax" function in the "mode_worcAction.php" component

Published Apr 28, 2021

7.5

HIGH

CVSS 3.1

EPSS 1.52%

Description

SQL Injection in Xinhu OA System v1.8.3 allows remote attackers to obtain sensitive information by injecting arbitrary commands into the "typeid" variable of the "createfolderAjax" function in the "mode_worcAction.php" component.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-89

SQL Injection

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-9948
Advisory
https://github.com/si1ence90/xinhu1.8.3_SqlInject
x_refsource_MISCExploitThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-9948		Advisory
https://github.com/si1ence90/xinhu1.8.3_SqlInject		x_refsource_MISCExploitThird Party Advisory