GESIO SQL injection vulnerability
CVE-2020-8967

10CRITICAL

Key Information:

Vendor: Gesio (gestión Integral Online, Sl)
Status: Gesio Erp
Vendor: CVE Published:; 1 June 2020

🔔 Create Gesio (gestión Integral Online, Sl) Vulnerability Alert

What is CVE-2020-8967?

There is an improper Neutralization of Special Elements used in an SQL Command (SQL Injection) vulnerability in php files of GESIO ERP. GESIO ERP all versions prior to 11.2 allows malicious users to retrieve all database information.

Affected Version(s)

GESIO ERP 11.2

References

https://www.incibe-cert.es/en/early-warning/security-advi...

x_refsource_CONFIRM

CVSS V3.1

Score:

Severity:

CRITICAL

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

None

Scope:

Changed

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Jun 1, 2020
Vulnerability Reserved
Feb 13, 2020

Credit

Francisco Palma, Luis Vázquez and Diego León.

CVE-2020-8967 Data

JSON