CVE-2020-13589

An exploitable SQL injection vulnerability exists in the ‘entities/fields’ page of the Rukovoditel Project Management App 2.7.2. The entitiesid parameter in the 'entities/fields page mulitpleedit or copyselected or export function is vulnerable to authenticated SQL injection. An attacker can make...

CVE-2020-13589

CVE-2020-13589 affects Rukovoditel Project Management App 2.7.2. The vulnerability exists in the web page “entities/fields” where the parameters entities_id, selected_fields, and heading_field_id are used in unauthenticated/authenticated SQL queries (mulitple_edit, copy_selected, export). The roo...

Rukovoditel Project Management App multiple SQL injection vulnerabilities in the 'entities/fields' page

Summary Multiple exploitable SQL injection vulnerabilities exist in the ‘entities/fields’ page of the Rukovoditel Project Management App 2.7.2. A specially crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger these vulnerabilities, this can b...