CVE-2020-23150

2021-08-0922:54:15

mitre

www.cve.org

sql injection

rconfig 3.9.5

config.inc.php

get request

sensitive database information

crafted request

ajaxdbinstall.php

AI Score

8.1

Confidence

High

EPSS

0.003

Percentile

69.1%

JSON

A SQL injection vulnerability in config.inc.php of rConfig 3.9.5 allows attackers to access sensitive database information via a crafted GET request to install/lib/ajaxHandlers/ajaxDbInstall.php.

References

github.com/rconfig/rconfig/blob/7ef8bd8d606bc10835e1b8f6f72a2048094816d3/www/install/lib/ajaxHandlers/ajaxDbInstall.php#L97