Lucene search

TwcertCVE-2020-10505

HistoryApr 15, 2020 - 7:15 a.m.

CVE-2020-10505

2020-04-1507:15:12

CWE-89

twcert

web.nvd.nist.gov

cve-2020-10505

school manage system

alle information co.

ltd.

sql injection

nvd

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.6

Confidence

High

EPSS

0.002

Percentile

51.6%

JSON

The School Manage System before 2020, developed by ALLE INFORMATION CO., LTD., contains a vulnerability of SQL Injection, an attacker can use a union based injection query string to get databases schema and username/password.

Affected configurations

Nvd

Node

the_school_manage_system_projectthe_school_manage_systemMatch-

VendorProductVersionCPE
the_school_manage_system_projectthe_school_manage_system-cpe:2.3:a:the_school_manage_system_project:the_school_manage_system:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
the_school_manage_system_project	the_school_manage_system	-	cpe:2.3:a:the_school_manage_system_project:the_school_manage_system:-:::::::*

CNA Affected

[
  {
    "product": "School Manage System",
    "vendor": "ALLE INFORMATION CO., LTD.",
    "versions": [
      {
        "status": "affected",
        "version": "before 2020"
      }
    ]
  }
]

References

www.chtsecurity.com/news/be93c576-e421-489f-9453-a462bdd4c90d

www.twcert.org.tw/tw/cp-132-3530-53d32-1.html

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.6

Confidence

High

EPSS

0.002

Percentile

51.6%

JSON

Related for CVE-2020-10505