CVE-2020-15884

2020-07-2314:15:12

Google

osv.dev

AI Score

8.5

Confidence

Low

EPSS

0.002

Percentile

54.7%

JSON

A SQL injection vulnerability in TableQuery.php in MunkiReport before 5.6.3 allows attackers to execute arbitrary SQL commands via the order[0][dir] field on POST requests to /datatables/data.

References

github.com/munkireport/munkireport-php/releases

github.com/munkireport/munkireport-php/releases/tag/v5.6.3

github.com/munkireport/munkireport-php/wiki/20200722-SQL-Injection-In-Datatables-Order-By-In-Post-Body