Blind SQL Injection Vulnerability in Metinfo 7.0 beta by Metinfo
CVE-2020-20585

7.5HIGH

Key Information:

Vendor

Metinfo

Status
Metinfo
Vendor
CVE Published:
8 July 2021

What is CVE-2020-20585?

A blind SQL injection vulnerability exists in the Metinfo 7.0 beta version within the /admin/?n=logs&c=index&a=dode endpoint. This flaw allows malicious actors to manipulate SQL queries by injecting crafted inputs, leading to unauthorized access to sensitive database information. As a result, attackers can extract confidential data stored in the backend, posing significant risks to organizations that utilize this software. It is imperative for users of Metinfo to apply security patches and follow best practices to mitigate this vulnerability.

References

https://www.metinfo.cn/
https://github.com/0xyu/PHP_Learning/issues/3

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.