CVE-2020-15947

2020-08-1314:09:50

mitre

www.cve.org

vulnerability

sql injection

queuemetrics

remote authenticated users

arbitrary sql commands

exportid parameter

AI Score

8.9

Confidence

High

EPSS

0.001

Percentile

44.5%

JSON

A SQL injection vulnerability in the qm_adm/qm_export_stats_run.do endpoint of Loway QueueMetrics before 19.10.21 allows remote authenticated users to execute arbitrary SQL commands via the exportId parameter.

References

blog.divisionzero.co/2020/08/12/cve-2020-15947/