CVE-2018-20469

EUVD-2018-13023
An issue was discovered in Tyto Sahi Pro through 7.x.x and 8.0.0. A parameter in the web reports module is vulnerable to h2 SQL injection. This can be exploited to inject SQL queries and run standard h2 system functions.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 90%
Affected Products (NVD)
VendorProductVersion
sahiprosahi_pro
𝑥
≤ 8.0.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://packetstormsecurity.com/files/153331/Sahi-Pro-8.x-SQL-Injection.html
https://barriersec.com/2019/06/cve-2018-20469-sahi-pro/
http://packetstormsecurity.com/files/153331/Sahi-Pro-8.x-SQL-Injection.html
https://barriersec.com/2019/06/cve-2018-20469-sahi-pro/