CVE-2020-10512

EUVD-2020-2965
HGiga C&Cmail CCMAILQ before olln-calendar-6.0-100.i386.rpm and CCMAILN before olln-calendar-5.0-100.i386.rpm contains a SQL Injection vulnerability which allows attackers to injecting SQL commands in the URL parameter to execute unauthorized commands.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
twcertCNA
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 57%
Affected Products (NVD)
VendorProductVersion
hgigaoaklouds_ccm\@il
-
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://gist.github.com/tonykuo76/d52014bbe81995eda499201446aec57a
https://www.chtsecurity.com/news/545daf88-adb4-4417-9870-426490c1429e
https://www.twcert.org.tw/tw/cp-132-3536-79545-1.html
https://gist.github.com/tonykuo76/d52014bbe81995eda499201446aec57a
https://www.chtsecurity.com/news/545daf88-adb4-4417-9870-426490c1429e
https://www.twcert.org.tw/tw/cp-132-3536-79545-1.html