1. Home
  2. CVE Database
  3. CVE-2020-8967
CRITICAL · 10.0

CVE-2020-8967

There is an improper Neutralization of Special Elements used in an SQL Command (SQL Injection) vulnerability in php files of GESIO ERP. GESIO ERP all versions prior to 11.2 allows malicious users to r...

Vulnerability Description

There is an improper Neutralization of Special Elements used in an SQL Command (SQL Injection) vulnerability in php files of GESIO ERP. GESIO ERP all versions prior to 11.2 allows malicious users to retrieve all database information.

CVSS Score

10.0

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
GesioErp< 11.2

Related Weaknesses (CWE)

CWE-89

References

FAQ

What is CVE-2020-8967?

CVE-2020-8967 is a vulnerability with a CVSS score of 10.0 (CRITICAL). There is an improper Neutralization of Special Elements used in an SQL Command (SQL Injection) vulnerability in php files of GESIO ERP. GESIO ERP all versions prior to 11.2 allows malicious users to r...

How severe is CVE-2020-8967?

CVE-2020-8967 has been rated CRITICAL with a CVSS base score of 10.0/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2020-8967?

Check the references section above for vendor advisories and patch information. Affected products include: Gesio Erp.