Vulnerability Description
PMB 5.6 contains a SQL injection vulnerability in the administration download script that allows authenticated attackers to execute arbitrary SQL commands through the 'logid' parameter. Attackers can leverage this vulnerability by sending crafted requests to the /admin/sauvegarde/download.php endpoint with manipulated logid values to interact with the database.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- http://forge.sigb.net/redmine/projects/pmb/files
- http://www.sigb.net
- https://www.exploit-db.com/exploits/48356
- https://www.vulncheck.com/advisories/pmb-logid-sql-injection
FAQ
What is CVE-2020-37105?
CVE-2020-37105 is a vulnerability with a CVSS score of 7.1 (HIGH). PMB 5.6 contains a SQL injection vulnerability in the administration download script that allows authenticated attackers to execute arbitrary SQL commands through the 'logid' parameter. Attackers can ...
How severe is CVE-2020-37105?
CVE-2020-37105 has been rated HIGH with a CVSS base score of 7.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-37105?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.