SQL Injection Vulnerability in PHPOK Product by QingGan
CVE-2020-21486

7.5HIGH

Key Information:

Vendor

PHPok

Status
PHPok
Vendor
CVE Published:
20 June 2023

What is CVE-2020-21486?

PHPOK version 5.4 is susceptible to an SQL injection vulnerability that enables a remote attacker to manipulate SQL queries through the _userlist function located in the framerwork/phpok_call.php file. Exploiting this vulnerability may lead to the unauthorized retrieval of sensitive information from the database, posing significant security risks if left unaddressed.

References

https://github.com/qinggan/phpok/issues/8

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.