CVE-2020-17506

🗓️ 12 Aug 2020 16:33:10Reported by mitreType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 187 Views🌐 WEB

Artica Web Proxy 4.30.00000000 SQL injection vulnerabilit

Reporter	Title	Published	Views	Family All 18
0day.today	Artica Proxy 4.3.0 - Authentication Bypass Exploit	13 Aug 202000:00	–	zdt
0day.today	Artica Proxy 4.30.000000 Authentication Bypass / Command Injection Exploit	22 Sep 202000:00	–	zdt
BDU FSTEC	The vulnerability of the fw.login.php component of the Artica Web Proxy management system allows a hacker to execute arbitrary code with root privileges.	1 Apr 202100:00	–	bdu_fstec
Circl	CVE-2020-17506	21 Sep 202020:38	–	circl
CNVD	ArticaTech Artica Web Proxy SQL Injection Vulnerability	20 Aug 202000:00	–	cnvd
Check Point Advisories	SQL Injection Over HTTP Traffic (CVE-2020-11530; CVE-2020-17463; CVE-2020-17506; CVE-2020-25990; CVE-2020-27481; CVE-2020-5766; CVE-2020-8655; CVE-2020-8656; CVE-2020-9465)	18 Nov 202000:00	–	checkpoint_advisories
Cvelist	CVE-2020-17506	12 Aug 202016:33	–	cvelist
Exploit DB	Artica Proxy 4.3.0 - Authentication Bypass	13 Aug 202000:00	–	exploitdb
Metasploit	Artica proxy 4.30.000000 Auth Bypass service-cmds-peform Command Injection	22 Sep 202017:41	–	metasploit
Nuclei	Artica Web Proxy 4.30 - Authentication Bypass/SQL Injection	16 Jun 202607:13	–	nuclei

NVD

Node

Source	Link
packetstormsecurity	www.packetstormsecurity.com/files/159267/Artica-Proxy-4.30.000000-Authentication-Bypass-Command-Injection.html
blog	www.blog.max0x4141.com/post/artica_proxy/
packetstormsecurity	www.packetstormsecurity.com/files/158868/Artica-Proxy-4.3.0-Authentication-Bypass.html

Parameter	Position	Path	Description	CWE
apikey	query param	fw.login.php?apikey=	SQL injection on apikey leading to authentication bypass	CWE-89
service-cmds-peform	query param	cyrus.index.php?service-cmds-peform=\|\|{}\|\|	Remote command execution via injected service-cmds-peform parameter	CWE-89

17 Jun 2026 02:59Current

9.9High risk

Vulners AI Score9.9

CVSS 27.5

CVSS 3.19.8

EPSS0.93967